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Abstract 

In the 1970s, Motorola developed a proprietary cipher known internally 
as Vulcan, implemented this cipher in a custom integrated circuit, and 
marketed a secure communications system based upon Vulcan under the 
trade name DVP. In this paper we reveal the Vulcan cipher algorithm and 
develop an effective real-time ciphertext-only cryptanalytic attack against 
it. We additionally present as much historical information as we have been 
able to obtain. 

1 Introduction 

Vulcan is a proprietary self-synchronizing stream cipher developed by Motorola 
in the mid-1970s for use in secure two-way radios. It was marketed under the 
trade name DVP, an acronym for digital voice protection. 

In this paper we reveal a complete description of the Vulcan cipher and pro- 
vide cryptanalysis capable of recovering the cryptovariable from a small amount 
of ciphertext in real time. To our knowledge, such information has never before 
appeared in the open literature. Internet searches reveal little more than a few 
pages of sparse and often inaccurate information [6, 7, 8]. 

Because Vulcan was developed in secret by Motorola, virtually nothing has 
been publically known about the details of its design. Although we are now 
certain of the technical aspects of Vulcan, we will never know the reasons why 
certain design decisions were made, nor can we be confident of the precise history 
of its development. 

1.1 Caveats 

Aside from a few marketing brochures, which are increasingly difficult to find 
nowadays, we are unaware of any substantial technical information that has been 
published regarding Vulcan or DVP. We wish to clarify in advance that some 
of the information contained in this paper, especially our statements regarding 
the history of Vulcan and the various code names used internal to Motorola, 
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cannot be independently verified and must therefore be considered mere conjec- 
ture. Nonetheless, every claim in this paper is made in good faith, in that we 
believe the information to be as accurate as possible, and we are not trying to 
deliberately deceive or mislead anyone. We certainly welcome any corrections 
or additions to the information presented in this paper. 

We are absolutely confident in our technical reporting of Vulcan because 
that information was determined solely via reverse-engineering. Furthermore, 
we verified the accuracy of our analysis by comparing simulation data to that 
obtained from genuine DVP hardware. 

1.2 Terminology 

Unless specifically stated to the contrary, all mathematical operations described 
in this paper are on the Galois Field GF(2). Accordingly, multiplication cor- 
responds to a logical AND function and addition corresponds to a logical XOR 
function. Additionally, we adopt digital filter terminology for shift register delay 
elements, using the notation to indicate a delay of one bit. 

In our figures, we use a square with the text z _1 inside it to denote a 1- 
bit delay element that is equivalent to a D flip-flop. We use a circle with a 
multiplication sign in to denote multiplication over GF{2), which is equivalent 
to a logical AND gate. We use a circle with a plus sign in it to denote addition 
over GF(2), which is equivalent to a logical XOR gate. 

As much as possible, we try to use cryptographic vocabulary appropriate 
for stream ciphers in this paper. As such, we prefer that the term key refer to 
the keystream generated by the stream cipher instead of the user-selected secret 
key, which we prefer to identify with the term cryptovariable (CV). 

Thus when we refer to a bit of key, we arc referring to a keystream bit 
that is added modulo-2 to plaintext to produce ciphertext during an encrypt 
operation, and added modulo-2 to ciphertext to produce plaintext during a 
decrypt operation. Likewise when we refer to a bit of cryptovariable, we are 
referring to a bit of the (preferably randomly selected) secret that must be 
shared amongst all users of the cryptosystem in order for secure communication 
to be possible. 

Additionally, we prefer the term ciphertext autokey (or the equivalent acronym 
CTAK) instead of cipher feedback (CFB) for describing the mode in which the 
Vulcan stream cipher operates. Ciphertext autokey implies that the keystream 
is generated automatically based solely upon prior ciphertext and the crypto- 
variable. This provides a self-synchronizing property that is advantageous for 
channels that do not easily provide for cryptographic synchronization [1]. 

As we previously mentioned, Vulcan is the internal code name by which 
the cipher presented in this paper is known to Motorola. Motorola marketed 
products based on the Vulcan cipher as DVP. We use the terms Vulcan and 
DVP more or less interchangeably in this paper, but observe the convention 
that Vulcan can only refer to the cipher itself, whereas DVP can refer to either 
the cipher or a product that incorporates it. 
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As a final comment concerning Motorola trade names, we briefly mention 
the trademark Securenet [15]. Securenet refers to a broad family of secure voice 
products that are all based on similar technology. Vulcan/DVP was the first 
member of the Securenet family followed by DES, DES-XL, DVP-XL, DVI-XL, 
and others. A DVP encryption module can be referred to as Securenet, but 
Securenet does not necessarily imply DVP encryption [6]. 

1.3 Background 

Based on the best information available, we believe that Motorola first began 
product development of digital encryption for two-way radios in 1973, although 
they had developed some of the necessary building blocks somewhat earlier than 
this. For example, US Patent #3639690, filed in 1969, describes a linear cipher 
algorithm allegedly known to Motorola as Zeus [12]. Zeus was the immediate 
predecessor of Vulcan and both ciphers have much in common. 

Zeus, shown in Figure 1, is a trivial stream cipher that generates a key 
bit from a linear sum modulo-2 of some combination (selected by the 26-bit 
cryptovariable) of the previous 26 ciphertext bits. Since Zeus is catastrophically 
weak, we will not discuss it further in this paper, aside from mentioning that 
Vulcan was allegedly the successor to Zeus. We arc uncertain as to whether 
Zeus was purely experimental or whether it was ever sold to an end user in an 
actual product. 



Figure 1: Zeus Cipher 

Rumors suggest that Vulcan was originally implemented using discrete logic 
ICs, but we have not been able to find any evidence of this. Such an imple- 
mentation during the mid-1970s would have been physically quite large and 
rather power hungry, although it is nearly certain that Vulcan would have been 
prototyped using discrete logic prior to designing a custom integrated circuit. 

Further rumors suggest that the earliest customers for DVP included the 
then newly-formed US Drug Enforcement Agency, as well as the Organization 
of Petroleum Exporting Countries. Salt Lake City was also an early customer 
of DVP [5]. 

Products marketed under the DVP trade name use the Vulcan cipher to 
encrypt digitized voice. The technique Motorola selected to digitize voice is 
continuously variable slope delta modulation (CVSD) at 12Kbps. Motorola 
developed a custom CMOS integrated circuit (code named Butterscotch) to 
perform CVSD encoding and decoding. This same IC was also used in secure 
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voice products that succeeded DVP, such as Motorola's DES encryption device, 
introduced around 1980. 

In a DVP-equipped radio, at the transmitter, microphone audio is converted 
to 12Kbps CVSD plaintext and is then subsequently encrypted using the Vulcan 
cipher, which operates in a self-synchronizing mode known as ciphertext autokey 
(CTAK). The resulting ciphertext is then modulated onto the RF carrier as 2- 
level FM and transmitted to the receiving radios. 

In a DVP-equipped radio, at the receiver the 2-level FM signal is demodu- 
lated and the digital ciphertext is recovered. These functions are performed by 
an IC (believed to be a MC6800 family microprocessor) known as the control 
and interface IC, also referred to using the code name Vanilla. The recovered 
ciphertext is decrypted by the Vulcan cipher and the resulting plaintext is con- 
verted back to analog audio by the CVSD decoder IC (Butterscotch). 

We believe it likely that Motorola's development of 12Kbps CVSD Securenet 
was inspired by NSA's VINSON (KY-57/KY-58) series of 16Kbps CVSD tactical 
voice security equipment, which was developed in the early 1970s, immediately 
prior to DVP [9]. 

The first radios to be offered with DVP were Motorola's Micor mobile and 
MX300 portable, both of which entered the market in 1975 [5]. In 1980 Motorola 
added the DES cipher to its Securenet encryption products as a more secure 
alternative to DVP. During the mid-1980s, Motorola replaced DVP with DVP- 
XL and DVI-XL, both incorporating new proprietary cipher algorithms that 
remain as yet unpublished. 

As a side note, the XL term when used regarding Securenet indicates a 
range extension technology best described in US Patent #4893339 [14]. The 
XL method, known internally to Motorola as REX, a diminutive of "range ex- 
tension", is a clever technique of converting a block cipher operating in 1-bit 
cipher feedback (CFB) mode into a block cipher operating in a sort of counter 
addressing mode. The essential idea is to eliminate the error propagation char- 
acteristics of CFB mode. Note that DVP-XL is not REX applied to DVP (Vul- 
can), but is instead REX applied to Linus, the proprietary cipher that replaced 
Vulcan. 

1.4 Motivation 

As to why we went to the effort to reverse-engineer and cryptanalyze Vulcan, we 
have several motives. First, we wish to preserve a historical cipher that would 
otherwise have been lost to the black hole that is corporate history. Nearly 
all proprietary ciphers have suffered this fate, and all seem destined to it unless 
some enterprising third party intervenes. Our hope is that future cryptographers 
will find this paper an interesting and useful historical reference. 

Second, we seek to reinforce the strong argument that one must never trust 
ciphers that have not been exposed to open academic scrutiny. As our cryptanal- 
ysis will show, Vulcan is a catastrophically weak cipher, even when measured 
by 1970s standards. Vulcan would never have withstood public inspection and 
DVP would have been far less successful in the marketplace had its customers 
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known how vulnerable this cipher actually was. We strongly suspect that many 
other proprietary ciphers are similarly weak and we warn against their use. 

Third, we wish to assist budding cryptographers and reverse-engineers in 
learning the basic skills. Vulcan, being both simple and weak, offers an excel- 
lent learning opportunity for a beginning cryptographer. We believe that break- 
ing a Vulcan-encrypted message would be a suitable homework assignment for 
students enrolled in an undergraduate cryptography course. Other suitable as- 
signments might include investigating ways of making simple changes to Vulcan 
in order to improve its cryptographic strength. 

Fourth, we undertook this effort for sheer enjoyment. This project required 
us to learn many new skills and overcome many technical difficulties. Noth- 
ing beats the satisfaction gained from solving a giant puzzle. Nothing more 
thoroughly whets the appetite for knowledge than a secret. 

We imagine that Motorola would prefer that this paper did not exist, and 
we would not be surprised if they seek to remove it from the public eye, pre- 
sumably under the feeble justification that our work threatens the security of 
their customers. No doubt the real reason they might object to our work is to 
avoid embarrassment resulting from the disclosure that DVP is far from secure. 

In spite of these imagined protests, we are completely confident that no harm 
will come to any end users for the simple reason that Vulcan and DVP arc long 
obsolete and have not been used to protect sensitive communications in decades. 
For these same reasons, we are equally confident that no harm will be done to 
any active NSA signal intelligence efforts. Furthermore, we are confident that 
we have broken no laws in the course of our work, and we believe that this paper 
is both legally and technically legitimate. 

We want to make it perfectly clear that we do not wish to disparage Motorola 
with our comment that Vulcan is weak; quite the contrary, in its era DVP 
was revolutionary. We commend Motorola for developing the first digitally 
encrypted two-way radio available to non-military customers at a time when 
simple analog frequency inversion scrambling was considered "high tech" . 

Furthermore, we wish to allay any concerns that our revelations will in any 
way harm Motorola's intellectual property. Had this paper been published in 
1976, such a concern would have been legitimate, but in 2014 the technology 
underlying Vulcan and DVP is not only long obsolete, but absolutely archaic. 
None of Motorola's competitors have anything to gain, or even learn, from our 
disclosures. 

1.5 Technique 

We were surprised at how easy it was for us to learn the details of Vulcan. 
Although the Vulcan cipher is implemented in a custom CMOS integrated cir- 
cuit, techniques for reverse-engineering ICs are well known. We do not know 
why the myth still persists that reverse-engineering hardware is more difficult 
than reverse-engineering software. We caution that secrets cannot be hidden in 
silicon or software; only a fool believes otherwise. 
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The first step in our process was to acquire several DVP modules and a 
DVP key loader, both of which are inexpensive and readily available on eBay 
and at ham fests. We then examined the DVP modules to identify the purpose 
of the various ICs these modules contain. Our attention quickly focused on an 
IC labeled only with a Motorola logo and bearing the identifier SC76807 (see 
Figure 2). 



Figure 2: SC76807 Integrated Circuit 

Unlike plastic IC packages, which require strong acids to unveil the die, the 
SC76807 uses a ceramic and metal chip carrier package that can be de-capped 
with a large soldering iron. Once we removed the metal lid, the die was exposed 
for our inspection (see Figure 3). 

We imaged the die at a magnification of 200 using a metallurgical microscope 
and a digital camera, resulting in a clear view of the top metal layer of the 
die. We quickly determined that the SC76807 is a medium scale integration 
(MSI) metal gate CMOS chip of large geometry, typical of mid to late 1970s IC 
process technology. Although we did not count the individual gates, this is a 
fairly simple device, well within the ability of a single individual to analyze. 

Once we had an image of the Ml layer of the SC76807, we began analyzing 
the various circuits and their functions. Due to the large amount of repeated 
circuitry, this task was not nearly as time-consuming as we had originally ex- 
pected. Our detailed analysis of the SC76807 IC follows in Section 2. 

Once we fully understood the workings of the SC76807, we realized that this 
knowledge by itself was insufficient for a complete understanding of DVP. This 
is because the DVP key loader plays a significant role in the overall operation of 
DVP. We therefore had to obtain a DVP key loader and perform some reverse- 
engineering on it as well. 

Like the SC76807, the DVP key loader was easy to reverse-engineer, although 
in this case it was primarily software rather than hardware that we had to 
reverse-engineer. After reading the firmware ROM and disassembling the code, 
we quickly discovered the portions of this software that determine how the 71- 
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bit user-entered cryptovariable is converted into the 138-bit cryptovariable that 
the SC76807 requires. Our full analysis of the DVP key loader follows in a 
Section 4. 

Once we understood the requisite technical details of both the SC76807 
IC and the DVP key loader, we then created some software simulations that 
implement the Vulcan cipher. We used GNU Octave (an open-source alternative 
to Matlab) for our simulations and analysis, but our results can be replicated 
easily in other languages such as C++ or Python. All of our Octave source code 
is presented in the appendix. 

To test the validity of our simulations, we used the DVP key loader itself to 
create test vectors where the cryptovariable, plaintext, and ciphertext were all 
known. This allowed us to confirm that our software simulations were correct, 
and also provided verification that our analysis of both the SC76807 IC and the 
DVP key loader is accurate. 

After we had proven the validity of our software simulations, we then set 
about analyzing Vulcan from a mathematical perspective. Although we are 
not mathematicians per se, cryptanalysis of Vulcan requires little more than 
an undergraduate understanding of linear algebra. We note later in this paper 
that more elegant and efficient cryptanalytic attacks against Vulcan are almost 
certainly possible, and thus a topic ripe for further research. Nonetheless, our 
simple-minded attacks proved all too effective. 

2 SC76807 CMOS IC 

In this section, we present the findings of our hardware reverse-engineering 
effort. Figure 3 illustrates the top metal (Ml) layer of the SC76807 Vulcan IC. 
This chip is a metal-gate CMOS IC of large (> 1 micron) geometry. To avoid 
cluttering Figure 3 with labels, we will instead describe the various functions of 
the circuit elements in the paragraphs below. 

2.1 Technique 

Understanding the SC76807 IC was a new and interesting challenge for us since 
we had not previously reverse-engineered silicon integrated circuits. Fortunately 
for us, the large geometry and low gate count of 1970s-era medium scale inte- 
gration made it relatively easy to proceed. 

Understanding how bits are stored in volatile memory on an IC is a critical 
first step to reverse-engineering the SC76807. Many excellent tutorials can be 
found on the web, so we will not duplicate that effort here [10]. The key obser- 
vation is that a single bit is stored in a pair of inverters that are permanently 
coupled together. Such pairs of coupled inverters are plentiful in the SC76807. 

We assumed the SC76807 would consist largely of shift registers and static 
random access memory, something the visual presence of a large number of cou- 
pled inverters confirmed. We present a detailed analysis of the specific circuitry 
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of the SC76807 in a later section, but for now we will briefly mention what we 
discovered at our hrst glance. 

The large regular structure in the center of the chip is clearly an SRAM 
array. This is obvious due to the address decoding logic adjacent to the array, 
along with the pre-charge circuitry and the word and bit lines that connect to 
each cell. We quickly counted 128 individual bit cells. 

The numerous ladder-like structures are clearly shift registers, as evidenced 
by numerous pairs of coupled inverters separated by clocked gates. The repeti- 
tive nature of these circuits makes them easy to analyze. 

We strongly suspected that the single ladder-like structure that differed from 
all the rest was likely a tree of XOR gates, an assumption that later proved 
mostly correct. Other smaller circuits required more careful analysis to fully 
understand. Examples of these include the various signal switching circuits and 
the differential encoder and decoder. 

Although we had signal traces of all I/O pins that we captured with a logic 
analyzer, we did not have access to a schematic that provided names for these 
pins. We had to figure out the functions of the I/O pins by examining both the 
logic analyzer traces and the associated circuitry of the SC76807. 

2.2 A Guided Tour 

Before we discuss specific circuits, we must first establish pin numbers and the 
"correct" orientation of the chip. Figure 3 (when viewed with the caption at the 
bottom) displays the IC in our preferred orientation, with Pin 1 clearly visible in 
the upper right hand corner. Pin 1 is easily identified by the distinctly rounded 
corners of its bonding pad. 

We choose to numbers the pins, starting with Pin 1, in counterclockwise 
ascending order. We observe that there are seven pins along the top of the chip 
and six pins along the bottom. However, Figure 3 reveals that only six of the 
seven pins along the top of the die are bonded, with one unavailable external to 
the IC. We thus choose to omit the un-bonded pin and instead number only the 
twelve bonded pins from one to twelve, counterclockwise from the upper right 
hand corner. 

Using this scheme, in Figure 3 we have: Pin 1 in the upper right hand corner, 
Pin 6 in the upper left hand corner, Pin 7 in the lower left hand corner, and 
Pin 12 in the lower right hand corner. With this numbering scheme in place, 
we now proceed to discuss the name and function of each pin. 

2.2.1 Inputs and Outputs 

Pin 1 is C1/C2 (code select) input. It controls the cryptographic transformation 
and acts as an extra bit of cryptovariablc. This signal connects to the first XOR 
gate in the XOR tree and inverts the sense of the AND function that is used 
to enable or disable this XOR gate (this feature will be explained in a later 
section). This pin is normally low (selecting CI). 
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Pin 2 is cryptovariable input. It conveys the cryptovariable from the key 
loader to the IC during key loading operations. It is connected directly to the 
CV shift register seen at the far right of the chip. 

Pin 3 is plaintext input. It connects to some switching logic near the top cen- 
ter of the die. The switching logic routes plaintext and ciphertext to the appro- 
priate circuits depending on whether the chip is operating in encrypt (transmit) 
or decrypt (receive) mode. 

Pin 4 is TX/RX input. It selects whether the chip encrypts (TX) or decrypts 
(RX). This signal connects to the same switching logic circuitry as Pin 3. 

Pin 5 is ciphertext input. It connects to a differential decoder and then to 
the switching circuitry that routes it appropriately based on whether the chip 
is encrypting or decrypting. 

The un-bonded pin between Pin 5 and Pin 6 is a test output that is inacces- 
sible external to the chip. This test pin allows the contents of the 128-bit SRAM 
(discussed later) to be read, presumably to enable testing of the SRAM during 
manufacturing. We have deliberately chosen not to give this pin a number since 
it has no function during normal operation. 

Pin 6 is V+, the positive supply voltage. It supplies Vdd to all the transistors 
on the chip. 

Pin 7 is ciphertext output. It is differentially encoded and is valid only 
during encrypt (transmit) operations. 

Pin 8 is clock input. It allows an externally sourced clock signal to act as a 
time base for all synchronous logic on the chip. External inputs to the chip are 
clocked in on the rising edge of this clock. The nominal clock rate should be 12 
KHz during encrypt and decrypt operations, but we observe that the DVP key 
loader supplies a faster clock than this during key loading. 

Pin 9 is WE (write enable) input. When active (low), it allows the CV shift 
register to operate, clocking in CV bits from Pin 2 in accordance with the clock 
signal on Pin 8. Circuitry on the chip creates a single clock cycle delay between 
the WE input and the clock and CV inputs, an observation that is important 
when analyzing the exact temporal relationship of these three signals. 

Pin 10 is output-enable input. This signal must be high in order for cipher- 
text out (Pin 7) and plaintext out (Pin 11) to produce outputs. If Pin 10 is low, 
ciphertext out and plaintext out will be in high impedance states. 

Pin 11 is plaintext output. It connects to the bottom of the XOR tree and 
is only valid during decrypt operations. 

Pint 12 is ground. It provides Vss to all the transistors on the chip. 

2.2.2 Circuitry 

The large repetitive structure directly in the center of the chip is a static random 
access memory (SRAM) array of 128 bits, arranged as eight rows by sixteen 
columns. Address decoding circuitry is present immediately to the left of and 
immediately below the SRAM array. The SRAM address is determined by bits 
held in the shift register along the left side of the SRAM array. 
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At the far right side of the chip is a vertical column of circuitry, the CV shift 
register. It receives input from CV in (Pin 2) and is controlled by the clock (Pin 
8) and WE (Pin 9). When WE is high (inactive), the CV shift register does not 
shift. When WE is low, CV input bits from Pin 2 are clocked into the CV shift 
register on the rising edge of the clock. 

The CV shift register has a capacity of 10 bits and also supplies an output 
to the SRAM array. When WE is low, CV bits are clocked through the CV 
shift register and written into the 128-bit SRAM array in accordance with the 
address contained in the shift register to the left of the SRAM array. 

At the far left side of the chip are two vertical columns of circuitry. Together 
these form a 21-bit ciphcrtcxt shift register, with 14 bits in the left column and 
7 bits in the right column. The ciphertext shift register input comes from a 
switching circuit located directly above the SRAM array. 

The ciphertext shift register input is at the top of the right column and the 
ciphertext shift register output is at the top of the left column. Bits in the right 
column move down the circuitry and then across to the left column where they 
then move up the circuitry. The output of the ciphertext shift register connects 
to an XOR gate located above the SRAM array. 

The circuit immediately above the right column of the ciphertext shift reg- 
ister supplies bits of the cryptovariable to the SRAM array during key loading. 
The circuit below the right column of the ciphertext shift register is a differential 
encoder that encodes the output of the ciphertext shift register and supplies it 
to the ciphertext output (Pin 7). 

The newest seven bits in the ciphertext shift register form an address to the 
SRAM row and column address decoding logic. Each cell of the first seven bits 
in the ciphertext shift register supplies both inverted and non-inverted bits for 
use in addressing the SRAM array. 

The horizontal row of circuitry above the SRAM array performs a variety 
of functions. The leftmost circuit in this row is a read sense amplifier for the 
SRAM array, followed by an XOR gate that adds modulo-2 the output of the 
ciphertext shift register to the bit of cryptovariable that is addressed by the 
first seven bits of the ciphertext shift register. We will call the result of this 
operation a modified ciphertext bit. 

Modified ciphertext bits enter a 10-bit shift register that is the vertical col- 
umn of circuitry immediately to the right of the SRAM array. Modified cipher- 
text bits enter this shift register at the top and move down the circuitry. The 
modified ciphertext bits in this shift register are also transferred in parallel to 
the XOR tree, which is the column of circuitry immediately to the right of this 
shift register. 

Returning now to the circuitry above the SRAM array, immediately to the 
right of the circuit that forms the modified ciphertext bit, we have a differential 
decoder that decodes the ciphertext input signal of Pin 5 and supplies it to a 
switching circuit to the right of this differential decoder. 

Two such switching circuits are located at the right side of the row of cir- 
cuitry directly above the SRAM array. The leftmost of these switching circuits 
selects the ciphertext to be transferred to the ciphertext shift register. This 
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ciphertext comes from the output of the XOR tree during encrypt (TX) and 
comes from the differential decoder during decrypt (RX). 

The rightmost of these switching circuits selects the input of the XOR tree. 
The XOR tree input comes from plaintext in (Pin 3) during encrypt (TX) and 
comes from the output of the differential decoder during decrypt (RX). 

The XOR tree, visible as a vertical column of circuitry in between the mod- 
ified ciphertext shift register and the CV shift register, has 10 stages, each of 
which accepts an input from the previous stage, conditionally modifies this in- 
put, and then provides an output to the next stage. 

The modification performed by each stage of the XOR tree is simply a con- 
ditional exclusive-or (addition modulo-2), conditioned on the value of the cor- 
responding bit of CV from the CV shift register. The two bits being added 
modulo-2 are the input to this stage of the XOR tree and a corresponding bit 
of modified ciphertext from the modified ciphertext shift register. 

Certain stages of the XOR tree behave differently from the aforementioned 
general rule. Specifically, the first stage of the XOR tree is further modified by 
the value of C1/C2 (Pin 1). The last stage of the XOR tree never performs an 
XOR (i.e. acts as though the corresponding CV bit is always 0). The second- 
to-last stage of the XOR tree always performs an XOR (i.e. acts as though the 
corresponding CV bit is always 1). All other stages perform the XOR only if 
the corresponding CV bit is 1. If the corresponding CV bit is 0, the output of 
this stage is the same as its input. 

Immediately below the modified ciphertext shift register is a circuit that 
delays the WE signal by one clock cycle and then combines this signal with 
the master clock to create a clock signal for the CV shift register. The overall 
effect is that the CV shift register only clocks when WE is 0, and the effect of 
transitions on WE is delayed by one clock cycle relative to all other signals. 

The circuitry between Pin 7 and Pin 8 is a pair of test transistors. The 
thin column of circuitry at the far right edge of the SRAM array is pre-charge 
circuitry for the SRAM. All I/O input pins have diode protection and series resis- 
tance to guard against damage. This concludes our description of the SC76807 
circuitry. We turn now to the overall operation of the device. 

2.3 Modes of Operation 

The SC76807 IC can operate in at least three different modes: encrypt, decrypt, 
and key loading. Each of these modes affects how input and output signals are 
processed by the IC. Although the SC76807 IC is the device that performs the 
cipher operations, the overall DVP module itself consists of additional circuitry 
that we have not described here because it is not particularly interesting or 
relevant. 

During encrypt, the DVP module delivers plaintext CVSD bits to Pin 3 
of the SC76807 and receives ciphertext bits from Pin 9 of the SC76807. The 
TX/RX input on Pin 4 must be low. Each bit-wise encrypt operation requires 
the clock signal on Pin 8 to transition from low to high once the plaintext input 
is stable. The ciphertext output bit is retrieved on the falling edge of the clock 
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signal. The WE input on Pin 9 and the output enable input on Pin 10 must 
both be high during encrypt operation. 

During decrypt, the DVP module delivers received ciphertext bits to Pin 5 of 
the SC76807 and receives plaintext CVSD bits from Pin 11 of the SC76807. The 
TX/RX input on Pin 4 must be high. Each bit-wise decrypt operation requires 
the clock signal on Pin 8 to transition from low to high once the ciphertext 
input is stable. The plaintext output bit is retrieved on the falling edge of the 
clock signal. The WE input on Pin 9 and the output enable input on Pin 10 
must both be high during decrypt operation. 

During key loading, the DVP module, in conjunction with an external key 
loader, must supply cryptovariable bits on Pin 2, ciphertext input bits (used 
for SRAM addressing) on Pin 5, and an appropriate clock signal on Pin 8. The 
WE input on Pin 9 and the TX/RX input on Pin 4 must both be low. 

The DVP key loader only delivers cryptovariable and ciphertext input sig- 
nals. All other necessary inputs (including the clock) are supplied to the 
SC76807 IC by other circuitry on the DVP module itself. 

The DVP key loader specially constructs the ciphertext stream to ensure 
that the appropriate cryptovariable bits are written into the appropriate SRAM 
addresses. The first 128 bits of the cryptovariable are written into the SRAM 
array and the last 10 bits of the cryptovariable remain in the CV shift register. 

3 Vulcan Cipher Algorithm 

Vulcan is a self-synchronizing stream cipher with a 138-bit cryptovariable. In 
this section we describe the cipher in complete detail. 

Vulcan uses a ciphertext delay shift register to maintain a history of the 
most recent 31 bits of ciphertext for use in ciphering operations. The first seven 
of these 31 ciphertext bits form a 7-bit address into the 128-bit SRAM array. 

The SRAM array holds 128 bits of cryptovariable, and each time a message 
bit is encrypted or decrypted, the bit of cryptovariable addressed by the first 
seven bits in the ciphertext shift register is read from the SRAM array and is 
then added modulo-2 to the 21st bit in the ciphertext shift register. Therefore, 
the last 10 bits in the ciphertext shift register have been modified by certain 
bits of the cryptovariable. 

The primary ciphering mechanism of Vulcan is a tree of interconnected XOR 
gates that add modulo-2 certain ciphertext bits and cryptovariable bits to the 
input bit, where the input bit is a plaintext bit during encrypt, and is a cipher- 
text bit during decrypt. 

Figure 4 illustrates a Vulcan encrypt operation. Plaintext bits serially enter 
at the lower left in accordance with a clock signal (not shown). Differentially 
encoded ciphertext bits serially exit at the lower right. The differential encoder 
protects against arbitrary phase inversions on the communications channel and 
is of no cryptographic importance. A non-diffcrentially-encoded version of the 
ciphertext output bit feeds back to the ciphertext shift register near the upper 
left. 
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Figure 4: Vulcan Cipher Encrypt 


The most recent seven ciphertext bits in the ciphertext shift register form a 7- 
bit address to the SRAM, addressing one bit of the first 128 bits of cryptovariable 
(fcooo-'-fcm)- The specifically addressed bit of cryptovariable transfers to an 
XOR gate at the far right of the ciphertext shift register, where it adds modulo- 
2 to the 21st bit of ciphertext. The bit resulting from this XOR then enters 
the modified ciphertext shift register, which holds 10 bits (only 9 of which are 
shown) . 

The bits in the modified ciphertext shift register are added modulo-2 to the 
plaintext bit, under conditional control of the last 8 cryptovariable bits (with 
the exception of the last bit in the modified ciphertext shift register). In effect, 
the 8 bits of cryptovariable (fciso-.-fcm) act as switches that either enable or 
disable the corresponding XOR gate. 

If the given cryptovariable bit is 1, then the corresponding XOR gate adds 
the modified ciphertext bit to the partial ciphering result. If the given crypto- 
variable bit is 0, then the XOR gate is disabled and the partial ciphering result 
simply passes on to the next XOR gate unmodified. 

Although the GF(2) multiplication (equivalent to a logical AND) shown here 
is nonlinear, we can think of the overall effect of this multiply as simply enabling 
or disabling the GF(2) addition (logical XOR) for this stage of the operation. 
This perspective becomes important when we attempt cryptanalysis of Vulcan 
in a later section. 

A quick review of the XOR tree and its associated circuitry on the SC76807 
IC reveals that the XOR tree has a total of 10 stages, whereas we show only 9 
stages in Figure 4. This is because the logic of the last two stages is different 
from that of the first eight stages. 

The last stage of the XOR tree, which would have been controlled by cryp- 
tovariable bit fci28, simply passes its input to its output without modification. 
This is why we omitted it from Figure 4. 

The second to last stage of the XOR tree always adds the modified ciphertext 
bit to the partial ciphering result, which is why this stage lacks the AND gate 
that would have been controlled by cryptovariable bit k\2g. 

As a consequence of how the last two stages of the XOR tree operate, cryp- 
tovariable bits k\28 and £129 have no effect whatsoever. Not surprisingly, these 
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bits and are always set to 0 by the DVP key loader. Therefore, even though the 
loaded cryptovariable is in fact 138 bits long, only 136 bits influence ciphering 
operations. 

Interestingly, although Vulcan uses a 138-bit cryptovariable (of which only 
136 bits have any effect), the DVP key loader only allows the end user to enter 
a 71-bit cryptovariable. Of the remaining 67 bits, two bits are always set to 0, 
and 65 bits are formed from linear combinations of the user-supplied 71 bits. 
We will discuss this fact in much greater detail in later sections of this paper. 

Figure 5 illustrates a Vulcan decrypt operation, which is nearly identical to 
the Vulcan encrypt operation shown in Figure 4. Differentially encoded cipher- 
text bits serially enter at the lower left in accordance with a clock signal (not 
shown). These bits are then differentially decoded to remove any dependence 
on phase characteristics of the communications channel. Differential decoding 
is of no cryptographic significance, but is shown here for completeness. 
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Figure 5: Vulcan Cipher Decrypt 


The differentially decoded ciphertext bit then enters both the XOR tree 
logic at the bottom of Figure 5, and the ciphertext shift register at the top 
of Figure 5. Once the ciphering operation is complete, plaintext bits serially 
exit at the lower right. All other decrypt operation is identical to the encrypt 
operation previously described. 


3.1 Mathematical Description 

For all stream ciphers, encrypt and decrypt operations are essentially identical 
except for the inputs and outputs [1]. To encrypt, add the keystream to the 
plaintext input to obtain the ciphertext output. To decrypt, add the keystream 
to the ciphertext input to obtain the plaintext output. In both cases the cipher 
is fully described by the keystream it generates. 

Vulcan generates its keystream as a linear combination of prior ciphertext 
bits and cryptovariable bits. In the description below, we consider the theoreti- 
cal case where all 138 bits of the Vulcan cryptovariable can be freely specified by 
the end user. In actuality, DVP only allows the end user to specify 71 of these 
138 cryptovariable bits, with the remaining 67 bits being a linear combination 
of the 71. 
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We have designated the 138 cryptovariable bits as &000 through fci 3 7 in the 
order that they are clocked into the SC76807 IC during key loading. We note 
that the first 128 bits of the cryptovariable are clocked into various locations in 
the SRAM array, whereas the last 10 bits of the cryptovariable are clocked into 
the CV shift register. 

For our purposes here, we do not care about the actual addressing of the 
SRAM so long as we remain consistent in our approach to how this addressing 
works. This will not be the case once we consider the specifics of the actual 
user-entered 71-bit cryptovariable, but for now it simplifies our mathematical 
description of Vulcan. 

Let each SRAM storage cell contain the cryptovariable bit identified by the 
number that is the SRAM address (i.e. SRAM location 000 contains fcooo, 
SRAM location 001 contains fcooi, etc.) We therefore have fcooo through ^127 in 
SRAM locations 000 through 127. Furthermore, let the CV shift register contain 
cryptovariable bits /ci 28 through fc 137 in locations 10 (the bottom) through 1 (the 
top) respectively. 

Using the notation that c(n — x) designates a ciphertext bit from x clock 
cycles ago, and using ordinary (as opposed to GF{2)) arithmetic for the SRAM 
address computation, we can express the present keystream bit, K(n), as: 

K(n) = (fci37 AND (c(n— 22) XOR fe(64c(n-8)+32c(n-7)+16c(n-6)+8c(n-5)+4c(n-4)+2c(n-3)+c(n-2)))) 
XOR (&136 AND (c(n— 23) XOR fc( 6 4 c („_9) + 32 c ( n _8)+16c(n-7)+8c(n-6)+4c(n-5)+2c(n-4)+c(n-3)))) 
XOR (fcl35 AND (c(n-24) XOR fc( 6 4c(n-10)+32c(ri-9) + 16c(n-8)+8c(n-7)+4c(ri-6)+2c(ri-5)+c(n-4)))) 
XOR (fci34 AND (c(n— 25) XOR fc( 6 4 c („_ 11 ) +32c („_io) + 16c(n-9)+8c(n-8)+4c(n-7)+2c(n-6)+c(n-5)))) 
XOR (fel33 AND (c(n— 26) XOR fc(64c(n-12)+32c(ri-ll) + 16c(ri-10)+8c(n-9)+4c(n-8)+2c(ri-7)+c(n-6)))) 
XOR (fei32 AND (c(n— 27) XOR fc( 6 4 c („_i3) + 32 c ( r( _12) + 16c(n-ll)+8c(n-10)+4c(n-9)+2c(n-8)+c(n-7)))) 
XOR (fel3l AND (c(n— 28) XOR fc(64c(n-14)+32c(n-13) + 16c(n-12)+8c(n-ll)+4c(n-10)+2c(n-9)+c(n-8)))) 
XOR (fei30 AND (c(n— 29) XOR fc( 6 4 c („_ 15 ) +3 2 c („_i4) + i6c(n-13)+8c(n-12)+4c(n-ll)+2c(n-10)+c(n-9)))) 
XOR (c(n— 30) XOR fc(64c(n-16)+32c(n-15)+16c(n-14)+8c(n-13)+4c(n-12)+2c(n-ll)+c(n-10)))- 

(1) 

This equation reveals that the Vulcan keystream depends only on the value 
of certain prior ciphertext bits as well as certain cryptovariable bits. With the 
exception of the GF(2) multiplication operations (the logical ANDs), the rest of 
the equation is entirely linear (on GF(2)). This fact is of paramount importance 
in cryptanalysis. 

Given that DVP does not allow the end user to specify all 138 bits of the 
Vulcan cryptovariable, we now turn to the issue of how the DVP key loader 
transforms the 71-bit user-entered cryptovariable into the 138-bit version re- 
quired by the SC76807 IC. 
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4 DVP Key Loader 


Based on our analysis of the SC76807 IC and the Vulcan cipher it implements, 
we soon realized that our understanding of DVP was incomplete. We have just 
described the Vulcan cipher itself, but we have not yet described how the 71- 
bit cryptovariable entered by the end user into the DVP key loader affects the 
cipher. That is the topic of this section. 

Although there are several models of DVP key loaders, we acquired the 
Motorola T3010AX key variable loader (KVL) shown in Figure 6. The T3010AX 
is apparently the first revision of a second generation of DVP key loaders, the 
original being the relatively rare (and collectible) P1001 series of code inserters 
[8]. 
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Figure 6: T3010AX DVP Key Loader 
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4.1 Description and Operation 

Our T3010AX KVL has a TRN6777B cryptographic hybrid in it. This hybrid 
contains the SC76807 Vulcan IC and some additional non-cryptographic cir- 
cuitry that is of no interest here. It is the presence of the TRN6777B crypto 
hybrid within the KVL that allows us to gather a known triplet of cryptovari- 
able, plaintext and ciphertext that we can use to verify the correctness of our 
software simulations of the Vulcan cipher. 

The KVL is a relatively simple device that allows an end user to manually 
enter (via a membrane keypad) a cryptovariable into the key loader and then 
transfer this cryptovariable into a DVP-equipped radio. Unlike more modern key 
loaders (e.g. the KVL4000), the T3010 cannot generate a random cryptovariable 
(this fact alone is a rather serious security flaw). Instead, the user must manually 
enter 24 octal digits, with the final digit being restricted to values 0 to 3. Key 
entry proceeds in four groups of six octal digits each, with the intermediate 
result being displayed on a LED numeric display. The T3010 thus provides the 
user the ability to enter a 71-bit cryptovariable even though the Vulcan cipher 
itself requires a 138-bit cryptovariable. 

Internally, the KVL is based on a Motorola 6802 microprocessor that per- 
forms all the required functions except for encryption. Encryption is handled 
exclusively by the embedded TRN6777B hybrid. The 6802 processor primarily 
performs user interface functions such as handling the membrane keypad inputs 
and numeric LED display outputs. 

Interestingly, when transferring a cryptovariable from the KVL to a target 
radio (a process commonly referred to as key loading), communication is strictly 
one-way: from the KVL to the target. No provision exists for the target to 
communicate to the KVL. This means that the KVL cannot be certain that a 
key load operation was successful. Later generations of Sccurenet key loaders 
implemented bidirectional communications between the KVL and the target 
device. 

To overcome the problem of not knowing if a key loading process was suc- 
cessful or not, the KVL sends a short burst of encrypted CVSD immediately 
following the cryptovariable transfer. If the CV was successfully transferred, 
the target radio will correctly decrypt this ciphertext and play the resulting 
plaintext (a tone) on the radio speaker. Therefore, if the user hears a beep from 
the radio immediately after key loading, that means the CV was successfully 
loaded. If no beep occurs, the key load process failed and only static will be 
heard. 

If it were not for this unusual form of verification, the KVL would not require 
an internal crypto hybrid. The only reason the T3010 KVL has an internal 
TRN6777B hybrid is so that it can generate the correct ciphertext to send to 
the target radio to make it beep after a successful key load. We exploited this 
operation by capturing data with a logic analyzer and then used that data to 
confirm the validity of our software simulations of Vulcan. 
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4.2 Reverse Engineering 


Understanding the DVP key loader required us to reverse-engineer the 6802 
microprocessor firmware. To do this, we extracted the contents of the ROM that 
contains the 6802 firmware and then disassembled it. The firmware disassembly, 
along with a few of our comments, is listed in Appendix E. 

We quickly located several lookup tables and soon identified one as contain- 
ing messages that are displayed on the LED. From our experience using the 
DVP key loader, we knew that it displayed the message "beep?" when key 
loading was complete. We therefore determined the address of this message in 
the lookup table and then searched the code for a reference to this address. 

This led us to the section of firmware that contained the algorithm for con- 
verting the 71-bit user supplied cryptovariable into the 138-bit cryptovariable 
that the Vulcan IC requires. We call this conversion algorithm the key schedule 
and describe it fully below. Interested readers can refer to the firmware disas- 
sembly in Appendix E, but we caution that the code there is rather convoluted 
and far more difficult to understand than the summary description we provide 
here. 

4.3 Key Schedule 

As we have previously noted, DVP allows the user to specify a 71-bit cryptovari- 
able, but the Vulcan cipher itself requires a 138-bit cryptovariable. The DVP 
key loader converts the 71 user-entered bits into a 138-bit cryptovariable and 
then transfers this to the Vulcan IC. This conversion process is loosely analogous 
to the key schedule of many common ciphers. 

For convenience, we prefer the following terminology. Suppose that the end 
user enters a 24-digit octal cryptovariable into the KVL. We will designate 
these 24 octal digits as K23, the most significant digit and the first digit en- 
tered, through kqo, the least significant digit and the last digit entered (which 
is furthermore restricted to the octal values 0 through 3). 

Converting the 24-digit user-entered octal CV into 71 bits, we proceed left to 
right (i.e. from most significant to least significant) in a straightforward manner. 
We will designate the 71 bits of user-entered CV as V70 (most significant) through 
woo (least significant). Therefore: k 23 = v 70 .v 69 .v 68 , k 22 = v 67 .v 66 .v 64 , 
K01 = wo4- w 03- u 02, and k 00 = v 0 i-v 0 o (since it has only 2 bits, having been 
restricted to octal values 0 through 3). 

The DVP key loader converts this 71-bit user-entered CV, v 7 q...voo, into 
a 138-bit cryptovariable and then loads this into the SC76807 IC. The exact 
conversion and key loading process is somewhat convoluted, so we will describe 
it in general terms and then give the precise final result. 

Loosely speaking, the key loader creates a 64-bit data word from the 64 most 
significant user key bits (roughly bits V70...V07). This process involves iterated 
right shifts of each octal digit with the result that the final 64-bit data word is 
not a straightforward copy of w 70 through v 0 y (nor does it actually include Vq?). 

Once the DVP key loader has built the 64-bit data word, the DVP key loader 
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then computes a 64-bit parity word from the data word. The parity word is 
generated using a Galois linear feedback shift register and a dense feedback 
polynomial [2]. Precise details as to how this is done can be found in our key 
schedule simulation in Appendix A. 

Since the key loader started with 71 bits and used 64 of these to form the data 
word, seven bits remain leftover. The key loader gathers these seven leftover 
bits and creates an 8-bit data word from them. This data word contains user 
key bits vqq through vq^, vqq, vqj, as well as a fixed 0 bit. Details regarding 
the precise construction of this 8-bit word can be found in our key schedule 
simulation in Appendix A. 

If the Hamming weight of this 8-bit word is less than four, the DVP key 
loader complements this word so that the Hamming weight of the final result 
is always four or greater. This curiosity restricts the final permissible values of 
this 8-bit word to 163 values, of which only 128 are possible; a fact that is very 
useful for cryptanalysis. 

Once the DVP key loader has assembled the 64-bit data word, 64-bit parity 
word, and 8-bit data word, the key loader then builds a table of SRAM addresses 
and corresponding cryptovariable bits. Both the SRAM addresses (differentially 
encoded) and the cryptovariable bits are then clocked into the SC76807 IC 
during the key loading operation. A pair of null bits (always 0) fills the unused 
space between the bits placed in the SRAM and the bits placed in the CV shift 
register. Details regarding the key loading clock schedule can be found in our 
key schedule simulation in Appendix A. 

Ultimately the key loader effectively creates a key schedule that permutes 
the 71 bits of user-entered cryptovariable across 128 bits that are stored in the 
SRAM and 8 bits that are stored in the CV shift register. Our cryptanalysis 
simulation in Appendix D contains a matrix that lists the SRAM contents in 
terms of the user-supplied CV bits (vjo ... vqq) by address. This matrix is 
obviously useful for cryptanalysis. 

5 Simulations 

Our ultimate goal in reverse-engineering Vulcan was to understand it sufficiently 
well to allow us to create bit-exact software simulations. Accurate software sim- 
ulations of Vulcan eliminate the need for the custom IC and associated hardware 
and also enable experimentation and cryptanalysis. 

We chose to divide our software simulations into three major parts: the key 
schedule, encryption, and decryption. We used GNU Octave as our development 
environment of choice, and our simulations are all written in that language 
(which is also compatible with Matlab) . It should be very easy for anyone with 
software skills to port our Octave simulations to another environment, such as 
Python or Java. 
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5.1 Key Schedule 


We created an Octave script to simulate the portion of the DVP key loader that 
transforms the 71-bit user-entered cryptovariable into the 138-bit cryptovariable 
that gets clocked into the SC76807 IC during key loading. We provide a full 
listing of our script in Appendix A. Although our source code is well commented, 
we provide a broad overview of the operation here. 

We first check the 24-octal-digit user-supplied cryptovariable for simple er- 
rors and substitute a default test CV if necessary. Next we convert the 24 octal 
digits into 71 bits and then extract 64 of these bits to form the 64-bit data word. 
We then compute the 64-bit parity word from the 64-bit data word by using a 
Galois linear feedback shift register. We also form the 8-bit CV shift register 
contents from the leftover cryptovariable bits and complement it if necessary 
based on the Hamming weight rule. Finally, we create the 128-bit SRAM array 
and load it with the correct bits. The outputs of our key schedule script are the 
128-bit SRAM contents and the 8-bit CV shift register contents. 

5.2 Encrypt and Decrypt 

We created Octave scripts to simulate both Vulcan encrypt and Vulcan decrypt 
operations. Both require the outputs of the key schedule simulation in order 
to properly set up the 138-bit cryptovariable. As was the case with our key 
schedule simulation, our commented source code listings are in the appendix, 
with board overviews presented here. 

To encrypt, we first check for some common errors, and then we create a 
random initialization vector if none was supplied. We then iterate over each bit 
of user supplied plaintext to create a bit of ciphertext according to the Vulcan 
encryption algorithm. We compute the output of the XOR tree with each stage 
being conditionally controlled by cryptovariable bits in the CV shift register. 
Next we differentially encode the resulting ciphertext bit and save it. We then 
compute the SRAM address of the cryptovariable bit, and then add modulo- 
2 this CV bit to the 21st bit of the ciphertext shift register, thus producing 
the modified ciphertext bit. Finally, we clock the ciphertext shift register in 
preparation for the next plaintext input bit. 

Our decrypt simulation is nearly identical to our encrypt simulation; only 
the order of the operations change's. We once again check for some simple ini- 
tialization errors and then proceed to iterate on all the bits of the user supplied 
ciphertext. We differentially decode the ciphertext bit and then compute the 
SRAM address of the cryptovariable bit. We then add modulo-2 this crypto- 
variable bit to the 21st bit of the ciphertext shift register, thus producing the 
modified ciphertext bit. We then compute the output of the XOR tree using 
the same procedure as the encrypt simulation. Finally, we save the resulting 
plaintext bit and then clock the ciphertext shift register in preparation for the 
next ciphertext input bit. 

We note here that our software simulations in the appendix were optimized 
for simplicity of understanding, not for performance. When we turn to crypt- 
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analysis, we streamline our simulations somewhat, making them more efficient, 
but somewhat less easy to understand. 

6 Cryptanalysis 

Vulcan is especially vulnerable to cryptanalysis because it is very nearly a linear 
cipher. Although it has a long (for that era) cryptovariable, the linearity of the 
cipher defeats any beneficial effect of having a long cryptovariable. Indeed, 
we consider it ironic that Vulcan has such a long cryptovariable (of either 71 
or 138 bits, depending on how you look at it) given that it can be broken 
almost trivially. In the sections that follow, we show that far from requiring an 
exhaustive search of order 2 71 , Vulcan can be broken with an exhaustive search 
of only 2 7 . 

We emphasize that no special knowledge of cryptanalysis is necessary to 
break Vulcan; an undergraduate-level understanding of linear algebra is more 
than sufficient. And whereas a more knowledgeable and experienced cryptogra- 
pher might well come up with a far better attack than the one we present here, 
ours works in real time and is easy to understand. 

From (1) of Section 3, we obtain the necessary insight as to how to break 
Vulcan. The crucial observation is this: if we view the effect of GF(2) multi- 
plication as an enable/disable mechanism for the individual stages of the XOR 
tree, then the remainder of Vulcan is completely linear on GF{2). We now 
expand upon this idea in greater detail. 

Suppose that we know the 10-bit contents of the CV shift register (also recall 
that two of these 10 bits are always 0). This implies that we know which stages 
of the XOR tree actively add (over GF(2)) modified ciphertext bits to the final 
result, and which stages merely pass the intermediate result onto the next stage 
unmodified. Therefore, we can compute the present ciphertext bit as a linear 
combination of prior ciphertext bits and certain of the 128 unknown CV bits 
stored in the SRAM. 

If we so choose, we can approach cryptanalysis with the assumption that 136 
bits of the 138-bit cryptovariable are unknown (recall that two bits are always 
0). In fact however, only 71 bits of the 138-bit cryptovariable are linearly inde- 
pendent due to the processing of the DVP key loader. It matters not whether 
we assume 136 unknown CV bits or 71 unknown CV bits. Our attack works 
in either case, revealing all 138 bits of the cryptovariable, although slightly less 
ciphertext is required when we assume only 71 unknown CV bits. 

We have repeatedly emphasized that the user-specified DVP cryptovariable 
is only 71 bits even though the Vulcan cipher itself requires a 138-bit crypto- 
variable. The matrix in our cryptanalysis simulation in Appendix D lists the 
128-bit SRAM contents in terms of the 71 user-entered CV bits. We can ap- 
ply this matrix to the linear ciphertext equations to produce a second matrix 
that can be solved to reveal the cryptovariable bits. Our exact procedure now 
follows. 

For each bit of ciphertext we assume a known value of the corresponding 
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plaintext bit (i.e. we are mounting a known plaintext attack) . For our simulation 
we chose an all-zero plaintext for convenience; however, in a real-world situation 
a dotting pattern (0101...) would be preferred due to the nature of the CVSD 
encoder [3]. 

We now digress briefly to emphasize that a known plaintext attack is com- 
pletely legitimate when mounted against any cryptosystem based on CVSD au- 
dio encoding. This is because approximately half of all spoken speech is silence, 
and the CVSD waveform coder encodes silence as a simple dotting pattern. 
Therefore, approximately half of all plaintext will consist of this simple dotting 
pattern, making the known plaintext assumption a valid one [3]. 

For any stream cipher, assuming knowledge of the plaintext and having 
access to the corresponding ciphertext allows us to determine the keystream 
via modulo-2 addition [1]. In the case of Vulcan, (1) specifies the keystream 
precisely. 

To attack Vulcan, we collect delayed ciphertext bits to determine the cor- 
responding SRAM addresses of the cryptovariable. These CV bits from the 
SRAM are used to form the keystream, as indicated by (1). Although we do 
not know the value of these CV bits, we do know which specific CV bits were 
involved in forming a specific bit of the keystream. Furthermore, since we are 
mounting a known plaintext attack, we also know the value of the keystream. 

The net result is that we end up with a linear equation that relates certain 
SRAM CV bits to specific keystream bits. Again, we know the addresses of the 
SRAM contents, but not the values contained in these addresses. By iterating 
over the ciphertext bits we can create a matrix of linear equations that can be 
solved to reveal the unknown values of the SRAM contents. Our procedure for 
accomplishing this is in Appendix D. We now explain how it works. 

6.1 Automated Procedure 

We created two lookup tables and an Octave script to recover the entire cryp- 
tovariable from a ciphertext stream. The first lookup table is a 128 row by 64 
column matrix that describes the contents of the SRAM in terms of the 64-bit 
data word referred to in Section 4. Recall that this data word consists of 64 of 
the 71 user-entered cryptovariable bits, although not in a straightforward order. 
Given an SRAM address, this matrix provides the linear combination of CV 
bits that are stored in that address. 

The second lookup table is simply a list of the 128 possible values of the 
8-bit data word mentioned in Section 4. These eight bits reside in the CV shift 
register and control the operation of the corresponding stages in the XOR tree. 
Our procedure uses simple linear algebra to solve for 64 of the 71 unknown 
cryptovariable bits, and uses this list to guess the remaining seven bits until a 
consistent solution is found. In the worst case we must try all 128 values in the 
list, although typically the solution comes much sooner than this. 

Our cryptanalysis script begins by forming a null solution matrix of 64 rows 
by 65 columns, and by using the first entry from the second lookup table as the 
starting value of the eight CV bits in the CV shift register. We then proceed to 
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process the ciphertext, creating a single linear equation relating SRAM contents 
to keystream bits for each bit of ciphertext. For each such equation, we update 
our partially completed solution matrix until one of the following occurs: we 
found an inconsistent solution, we ran out of ciphertext bits, or we completely 
filled the solution matrix, which is now in row echelon form. 

When we guess the CV shift register bits incorrectly, we will eventually 
encounter an inconsistent equation (i.e. 0=1) and thus know that our guess 
was incorrect. Should this happen, we simply move on to the next value in the 
second lookup table, load that entry as the eight CV shift register bits, and 
start processing ciphertext bits from the beginning once again. 

When we guess the CV shift register bits correctly, our solution matrix 
will eventually be completely filled and will also be in row echelon form. At 
this point all we have to do is put the solution matrix in reduced row echelon 
form and read the solved cryptovariable bits from the rightmost column. Our 
final solution consists of our correct guess of the CV shift register bits and the 
rightmost column of the consistently completed solution matrix. 

The precise details of our procedure are evident in our commented source 
code listing of Appendix D, but here we offer a few additional remarks to aid 
understanding. From (1) of Section 3 we can compute a keystream bit from 
delayed ciphertext bits and cryptovariable bits. This equation is central to our 
cryptanalysis routine. 

For each bit of ciphertext, our cryptanalysis routine forms a linear equation 
based on (1) such that we have a linear (on GF{2)) combination of 64 unknown 
variables (cryptovariable bits) equal to a single known value (the keystream bit). 
We place this linear equation in our solution matrix and perform elementary 
row operations on it to ensure that our solution matrix is in row echelon form 
at all times. 

As we continue to process ciphertext bits (assuming we have an adequate 
supply), we will eventually reach one of two possible outcomes: a correct so- 
lution or an inconsistent solution. An inconsistent solution occurs when, after 
performing elementary row operations on a candidate equation, we obtain the 
impossible result that 0=1. A correct solution occurs when we have completely 
filled our solution matrix with 64 linearly independent equations, none of which 
resulted in an inconsistency. 

Once we have 64 linearly independent consistent equations in our solution 
matrix, we again use elementary row operations to fully reduce the matrix into 
reduced row echelon form. This simply places the 64 solved cryptovariable bits 
in the rightmost column of the matrix, thus completing our solution. 

Experimentally, we have found that approximately 100 ciphertext bits are 
necessary to generate a complete solution for the Vulcan cryptovariable. If our 
technique is expanded to allow all 138 bits of the Vulcan cryptovariable to be 
independently specified — a situation not permitted by the DVP key loader 
- then we can still solve for the 138 bits, but we require about an order of 
magnitude (i.e. 1000 bits) more ciphertext to obtain a full solution. Either way, 
our cryptanalysis routine runs in real time and does not require any significant 
computational resources. We are fully confident in our ability to recover a DVP 
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cryptovariable in real time solely from ciphcrtcxt captured over-the-air from an 
actual DVP-equipped radio (although we did not actually do so because we were 
unable to procure a working DVP-equipped radio) . 

Given that it is possible to recover the Vulcan cryptovariable from ciphertext 
in real time, we must declare this cipher to be trivially weak and unsuitable for 
providing even rudimentary privacy. Although modern computing resources 
have made such an attach simple, they are not necessary. 

Such an attack could have been accomplished 40 years ago, albeit somewhat 
less conveniently. We therefore speculate that DVP-secured radio communica- 
tions were routinely compromised during the era of their use, although we have 
no proof of this. Believing otherwise simply cannot be supported given the 
ease of breaking Vulcan. The inherent weakness of Vulcan raises a number of 
interesting questions, which are the topic of our next section. 

7 Conclusion 

In this paper we have completely exposed the proprietary Vulcan cipher used in 
Motorola DVP encryption modules of the 1970s. Furthermore, we have shown 
that Vulcan is trivially weak and we have presented a simple technique that 
enables real-time ciphertext-only cryptanalysis. Before ending this paper, we 
wish to present a few open questions, propose future work, and offer some 
general comments. 

7.1 Open Questions 

During our reverse-engineering and analysis of Vulcan, a number of questions 
came to mind. In this section we list some of those questions and offer our 
opinions regarding likely answers. 

Our first question is why Vulcan uses a 71-bit cryptovariable. This is a very 
unusual length and we are not aware of any other cipher with such a strange 
length for the cryptovariable. Furthermore, the end user is required to enter the 
cryptovariable as 24 octal digits, but this creates the awkward situation where 
the very last octal digit is restricted to the range of 0 to 3. Why did Motorola 
choose to truncate this last octal digit instead of simply allowing the user to 
enter 72 bits? This makes no sense to us. 

For that matter, why did Motorola not allow the user to enter all 138 bits 
of the Vulcan cryptovariable? We can only speculate as to the reasons behind 
this decision, but our best guess is that Motorola marketing felt that 138 bits, 
presumably entered as 46 octal digits, was simply too long for most users to 
manage. 

Even entering 24 octal digits in four groups of six digits, as must be done 
on the DVP key loader, is somewhat cumbersome. Certainly entering 46 octal 
digits using a primitive user interface such as that of the DVP key loader would 
be bothersome. Nonetheless, Vulcan requires a 138-bit cryptovariable. It seems 
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to us that it would have made more sense to either have allowed the user to 
enter all 138 bits, or to have made Vulcan use a shorter cryptovariable. 

As an aside, we also note that the DVP key loader lacks the ability to 
generate a random cryptovariable, requiring the user to enter a CV of their own 
creation. This is certain to lead to poorly-chosen values, as our experience is 
that many users of cryptographic equipment, when allowed to choose their own 
CV, will simply enter an easily guessed sequence such as 1234..., etc. 

One might intuitively think that limiting the CV to 71 bits greatly reduces 
overall security, given that the Vulcan CV is natively 138 bits; however, since the 
Vulcan cipher is effectively linear, the length of the CV is of little consequence. 
Solving a system of linear equations in 138 unknowns is scarcely more difficult 
than solving a system of linear equations in 71 unknowns (or far fewer, for 
that matter). Motorola most likely realized this and made their decision on 
cryptovariable length accordingly. 

Another possibility regarding the length of the cryptovariable is the influence 
of external constraints, such as export restrictions. We know that in the 1990s, 
the US government would only allow export of cryptography restricted to 40 or 
fewer bits of cryptovariable [4]. We do not know what the restrictions were in 
the 1970s, but we can safely assume they were no more permissive than they 
were in the 1990s, and were likely less so. Again we are left to guess as to what 
the true reasons behind Vulcan's unusual CV length were. 

Our second question is why Vulcan is so weak. Admittedly, cryptography 
was much less well understood in the early 1970s than it is today; nonetheless, 
anyone with an undergraduate education in mathematics would have known at 
that time that Vulcan was seriously weak. It would not surprise us if this was 
deliberate. 

Inspection of the SC76807 IC layout reveals certain clues as to alternatives 
the designers might have had in mind. Specifically, the XOR tree has provisions 
to accommodate additional bits from the CV shift register, yet this circuitry is 
not hooked up. Also, the ciphcrtcxt shift register has a provision for insertion 
or extraction of bits approximately half-way through its 21 bits, a feature that 
was not used and the purpose of which is not clear to us. 

Strictly speaking, Vulcan is nonlinear due to the GF(2) multiplications 
present in the XOR tree; however, as we have shown, we can linearize Vul- 
can by assuming these GF(2) multiplications simply represent bits that must 
be solved for via exhaustive search. Since there are only seven unknowns, this 
exhaustive search is trivial. The designers could have made exhaustive search 
far less fruitful by including more bits from the CV shift register in the GF(2) 
multiplications, but they chose not to do so. We are puzzled by this. 

Furthermore, even a simple nonlinear operation in the ciphertext mixing 
function would have eliminated the simple attack of linear algebra, but the 
designers chose not to do this either. We cannot offer a reasonable explanation 
why a simple nonlinearity was not included in order to strengthen Vulcan. Our 
suspicion is that Vulcan is deliberately weak, although we have no proof of 
this. Nonetheless, we prefer this explanation to the alternative possibility that 
the designers were simply incompetent. Now that Vulcan has been thoroughly 
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exposed, it would be enlightening if one of its creators stepped forward with the 
rationale behind the design decisions. 

If Vulcan was designed solely to prevent casual eavesdropping then it was 
undoubtedly successful in achieving that goal. We are unaware of so much as a 
rumor of anyone publicly admitting success in recovering DVP encrypted voice. 
Indeed, most hams and hobbyists seem to have been sufficiently frustrated by 
various analog scrambling schemes, which were widely used to protect radio 
communications during the same era as DVP [11]. 

On the other hand, if Vulcan was intended to prevent determined adversaries 
from monitoring secret communications, we cannot believe it would have had 
any success in this regard. No intelligence agency anywhere in the world would 
have had difficulty cracking Vulcan in the 1970s. Perhaps when NSA declassifies 
some of their signals intelligence operations of the 1970s — something not likely 
to occur for another 60 years — future cryptographers will have solid evidence 
of this claim. 

7.2 Future Work 

Regarding future work, we have little doubt that a skilled cryptographer can 
greatly improve upon our simple cryptanalytic attack, although there is little 
motivation to do so. Such talent should be reserved for greater challenges, 
which leads us to comment that that Vulcan is merely one of several proprietary 
ciphers developed by Motorola. We suspect that the others might prove far more 
interesting. 

Specifically, we know that Vulcan was replaced with an allegedly much 
stronger cipher known internally as Linus sometime in the early 1980s. Li- 
nus was sold under the trade name DVP-XL and is alleged to have a 96-bit 
cryptovariable [6] . We know that the early implementations of Linus were done 
on a fully custom programmable cryptographic IC known as Son of Vulcan or 
SOV and marked as SC380001. 

The challenge in reverse-engineering SOV is that it is a programmable device 
that can implement many different ciphers, including Vulcan itself, depending 
on how it is programmed. Not only would one have to reverse-engineer the hard- 
ware, one would also have to successfully extract the contents of the EEPROM 
memory of the SOV IC and determine how this data controls the chip. 

Son of Vulcan was also used to implement algorithms other than Vulcan and 
Linus. Specifically, we know of an export algorithm referred to internally as 
Lucy and marketed at DVI-XL, as well as several different variations of Lucy 
that were sold as DVI-SPFL for Lucy Special Flavor. There are rumored to be 
many special flavors of Lucy, but we have no confirmation of this. 

Nothing is publically known about Linus or any of the various flavors of Lucy. 
We would be eager to learn the details of these ciphers, but reverse-engineering 
them will be considerably more difficult than reverse-engineering Vulcan. We 
would hope that these algorithms are more secure than Vulcan, although we 
have no doubt that Lucy was deliberately weakened to comply with US export 
restrictions on cryptography. 


27 


Linus and Lucy might also have been implemented in forms other than the 
SOV IC, perhaps even in software. We are simply unaware of specific details 
and would welcome further information and analysis. As with Vulcan, all of 
these proprietary ciphers have been rendered obsolete in favor of more recent 
ciphers such as AES. Nonetheless, Linus and Lucy are tempting targets. 

For that matter, Motorola is far from the only manufacturer that sold pro- 
prietary cryptographic devices. We know of many different manufacturers of 
equipment, much of which is now cheaply available at ham fests and on eBay. 
Recent advances in tools and techniques for reverse-engineering place most his- 
torical cryptographic equipment within easy reach of anyone with the will to 
understand how these devices work. 

7.3 Epilog 

We undertook this endeavor primarily as a learning exercise. We hope that 
others will find this material both interesting and informative. Furthermore, we 
hope this project inspires others to undertake similar projects, uncovering the 
hidden secrets lurking beneath every proprietary cryptographic device. Many 
such proprietary devices exist, providing ample material for would-be reverse- 
engineers and cryptographers. The Son-of- Vulcan device we mentioned is but 
one of a plethora. 

Many older cryptographic devices are simple enough to allow a complete 
analysis by a single individual. However, some devices are sufficiently complex 
to require a team effort to fully reverse-engineer and understand. To this end, we 
recognize and wish to call attention to the need for an anonymous and secure 
collaboration framework that would allow multiple team members to remain 
anonymous while still enabling cooperation on potentially sensitive work such 
as cryptographic reverse engineering. Anyone seeking a noble thesis project 
should give serious thought to this most critical need. 
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A Vulcan Key Schedule Simulation 


% 

% Vulcan "key schedule" simulation 
% 2014-05-28 — CJR 

'/, input: 24-digit octal cryptovariable "cv" 

'/, outputs: 128-bit SRAM array "sram" 

'/, 8-bit CV shift register "cv8" 

'/, converts 71-bit user-supplied CV into 138-bit Vulcan CV 

'/, prints out various intermediate results for inspection 

y, 

'/, check for user-supplied input & substitute default if none 
if ((exist Ocv') == 0) I I (length(cv) != 24)) 
cv= [7 6543210,... 

76543210,... 

7654321 0]; 

end 

'/, convert CV from 24 octal digits to 72 bits 
cvb = zeros (1,72); 
for ii = 1:24 
dig = cv(ii) ; 
for jj = 1:3 

cvb(3*(ii-l)+(3-jj)+l) = mod(dig,2); 
dig = floor(dig/2) ; 
end 
end 

printf ("CV = 7.0d 7.0d 7.0d %0d 7.0d 7.0d 7.0d %0d 7.0d 7.0d 7,0d 7.0d °/,0d '/,0d '/„0d 7.0d 7.0d. . . 

7.0d '/„0d 7,0d '/„0d 7.0d 7.0d %0d\n" , reshape (cvb , 3 , 24) '* [4 2 1]'); 
7. toss out MSB of last octal digit to get correct 71-bit CV 
cvb = [cvb(l:69) cvb (71: 72)]; 
'/, form 64-bit data word from 64 bits of CV 
cv64 = reshape(cvb(l :66) ,3,22) ' ; 
cv64 = reshape (f lipud(cv64) ' ,1,66) ; 
cv64 = cv64(3:66); 

printf ("data64 = 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X\n" , . . . 

reshape(cv64,8,8) '*[128 64 32 16 8 4 2 1]'); 
7. compute 64-bit parity word from 64-bit data word 
pr64 = zeros (1,64) ; 


[0, 

1, 

0, 

1, 

0, 

0, 

1, 

0, . 

o, 

0, 

0, 

0, 

0, 

0, 

0, 

0, . 

1, 

0, 

0, 

1, 

1, 

0, 

1, 

1. • 

1, 

1, 

1, 

1, 

0, 

0, 

0, 

1. • 

1, 

1, 

1, 

0, 

1, 

1, 

0, 

1. • 

o, 

1, 

0, 

0, 

0, 

0, 

0, 

0, . 

1, 

1, 

1, 

0, 

1, 

0, 

1, 

0, . 

1, 

1, 

0, 

0, 

0, 

0, 

1, 

0]; 


for ii = 64:-l:l 

bb = bitxor(cv64(ii) ,pr64(64)) ; 

pr64 = [0 pr64(l:63)] ; 

if(bb == 1) 

pr64 = bitxor(pr64,taps) ; 

end 
end 

pp = mod(sum(cv64) ,2) ; 
pr64 = [pp pr64(2:64)] ; 

printf ("parity64 = 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X 7.02X\n" , . . . 
reshape(pr64,8,8) '*[128 64 32 16 8 4 2 1]'); 
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'/, form 8-bit data word from 7 bits of CV 

cv8 = [0 cvb(70) cvb(71) cvb(67) cvb(68) cvb(69) cvb(64) cvb(65)] ; 
if(sum(cv8) <= 3) 

cv8 = bitxor(cv8, ones (1,8)); 
end 

printf ("data8 = 7.02X\n", cv8*[128 64 32 16 8 4 2 1]'); 
7. clock out the 138-bit cryptovariable in correct order 

elk = [pr64(64) pr64(63) pr64(62) pr64(61) pr64(60) pr64(59) pr64(58) cv64(64)] ; 


elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 
elk 


= [elk pr64(57) pr64(56) pr64(55) pr64(54) pr64(53) cv64(63) cv64(62) pr64(52)] 

= [elk pr64(51) pr64(50) pr64(49) cv64(61) pr64(48) cv64(60) pr64(47) pr64(46)] 

= [elk pr64(45) cv64(59) 

= [elk pr64(42) pr64(41) pr64(40) 

= [elk pr64(37) cv64(51) cv64(50) 

= [elk pr64(34) pr64(33) 

= [elk cv64(41) pr64(31) pr64(30) pr64(29) pr64(28) 

= [elk pr64(27) pr64(26) pr64(25) 

= [elk pr64(21) cv64(35) cv64(34) pr64(20) cv64(33) 


cv64(58) cv64(57) cv64(56) pr64(44) pr64(43) cv64(55)] 

cv64(54) pr64(39) cv64(53) cv64(52) pr64(38)] 

cv64(49) pr64(36) cv64(48) pr64(35) cv64(47)] 

cv64(46) cv64(45) cv64(44) cv64(43) cv64(42) pr64(32)] 

cv64(40) cv64(39) cv64(38)] 

cv64(37) pr64(24) pr64(23) cv64(36) pr64(22)] 

cv64(32) pr64(19) 

cv64(27) cv64(26) 


[elk pr64(18) cv64(30) cv64(29) pr64(17) cv64(28) 

[elk pr64(16) cv64(24) cv64(23) pr64(15) pr64(14) pr64(13) cv64(22) 

[elk pr64(12) cv64(20) pr64(ll) pr64(10) cv64(19) pr64(09) cv64(18) 

cv64(15) cv64(14) 


[elk cv64(16) pr64(08) 

[elk cv64(ll) pr64(05) pr64(04) 

[elk pr64(01) cv64(07) 

[elk 0 0 cv8(8) cv8(7) 


cv64(31)] 
cv64(25)] 
cv64(21)] 
cv64(17)] 
cv64(12)] 
cv64(08)] 
cv64(01)] 


cv64(13) pr64(07) pr64(06) 
pr64(03) cv64(09) pr64(02) 
cv64(06) cv64(05) cv64(04) cv64(03) cv64(02) 
cv8(6) cv8(5) cv8(4) cv8(3) cv8(2) cv8(l)]; 
printf ("138 bits clocked out of DVP key loader:\n"); 

printf C"/„0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

•/.Od '/.Od 7,0d 7.0d 7.0d\n" , clk(l:23)); 

printf ("7.0d '/.Od '/.Od '/.Od '/.Od 7.0d 7,0d '/.Od 7.0d '/.Od '/.Od 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

7.0d 7.0d 7.0d 7.0d 7.0d\n", elk (24: 46)); 

printf ("7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

7.0d 7.0d 7.0d 7.0d 7.0d\n", elk (47: 69)); 

printf ("7.0d 7.0d 7.0d 7.0d 7.0d 7„0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

7.0d 7.0d 7.0d 7.0d 7.0d\n", elk (70: 92)); 

printf ("7.0d 7.0d 7.0d 7.0d 7.0d 7„0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

7.0d 7.0d 7.0d 7.0d 7.0d\n" , clk(93: 115)) ; 

printf ("7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d V.Od 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d 7.0d... 

7.0d 7.0d 7.0d 7.0d 7.0d\n" , elk (116 : 138) ) ; 
7, place 64 data bits and 64 parity bits into 128-bit SRAM at correct addresses 
sram = zeros (1 , 128) ; 


[000, 

001, 

002, 

004, 

008, 

016, 

032, 

065, . 

003, 

006, 

012, 

024, 

048, 

097, 

066, 

005, . 

010, 

020, 

040, 

081, 

035, 

071, 

015, 

030, . 

060, 

121, 

114, 

100, 

072, 

017, 

034, 

069, . 

Oil, 

022, 

044, 

089, 

051, 

103, 

078, 

029, . 

058, 

117, 

106, 

084, 

041, 

083, 

039, 

079, . 

031, 

062, 

125, 

122, 

116, 

104, 

080, 

033, . 

067, 

007, 

014, 

028, 

056, 

113, 

098, 

068, . 

009, 

018, 

036, 

073, 

019, 

038, 

077, 

027, . 

054, 

109, 

090, 

053, 

107, 

086, 

045, 

091, . 

055, 

111, 

094, 

061, 

123, 

118, 

108, 

088, . 

049, 

099, 

070, 

013, 

026, 

052, 

105, 

082, . 

037, 

075, 

023, 

046, 

093, 

059, 

119, 

110, . 

092, 

057, 

115, 

102, 

076, 

025, 

050, 

101, . 

074, 

021, 

042, 

085, 

043, 

087, 

047, 

095, . 

063, 

127, 

126, 

124, 

120, 

112, 

096, 

064] ; 


for ii = 1:128 

sram(addr (ii)+l) = clk(ii) ; 
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end 
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B Vulcan Encrypt Simulation 

t 

'/, Vulcan encryption simulation 
% 2014-06-12 — CJR 

'/, inputs: 128-bit SRAM array contents "sram" 

'/, 8-bit CV shift register contents "cv8" 

'/, n-bit plaintext "pti" 

'/, (31-bit ciphertext shift register contents "ctsr") 

*/„ outputs: n-bit ciphertext "cto" 

encrypts plaintext into ciphertext using Vulcan cipher 
'/, requires "key schedule" to have been run prior to use 
% 

'/, check user-supplied inputs for simple errors 
if ((exist ('sram') == 0) I I (length(sram) != 128)) 

error ("128-bit SRAM array not found — run key schedule") 
end 

if ( (exist Ccv8') == 0) I I (length(cv8) != 8)) 

error("8-bit CV shift register not found — run key schedule") 
end 

if (exist('pti') == 0) 

error ("plaintext input not found — create some plaintext") 
end 

if ((exist('ctsr') == 0) I I (length(ctsr) != 31)) 

ctsr = 1* (rand(l , 31)>0 . 5) ; "/, create random initialization vector 
end 

°/, set up required variables 

last = 0; '/, last plaintext output bit for differential encoder 
cto = zeros (1 , length (pti) ) ; '/, pre-allocate ciphertext output 
'/, process all bits of plaintext input 
for ii = 1 : length (pti) 

'/, compute the X0R tree results 

ctO = pti (ii) ; 

ctO = bitxor(ct0,bitand(cv8(l) ,ctsr(22))) ; 
ctO = bitxor(ct0,bitand(cv8(2) ,ctsr(23))) ; 
ctO = bitxor(ct0,bitand(cv8(3) ,ctsr(24))) ; 
ctO = bitxor(ct0,bitand(cv8(4) ,ctsr(25))) ; 
ctO = bitxor(ct0,bitand(cv8(5) ,ctsr(26))) ; 
ctO = bitxor(ct0,bitand(cv8(6) ,ctsr(27))) ; 
ctO = bitxor(ct0,bitand(cv8(7) ,ctsr(28))) ; 
ctO = bitxor(ct0,bitand(cv8(8) ,ctsr(29))) ; 
ctO = bitxor(ct0,ctsr(30)) ; 

% differentially encode and save the output ciphertext bit 

cto(ii) = last; 

last = bitxor(ct0,last) ; 

compute the current SRAM address 
addr = ctsr(l :7) ; 
addr = addr* [1 2 4 8 16 32 64] ' ; 
addr = addr+1 ; 

•/, combine SRAM bit with CT21 
keyb = sram(addr); 
mO = bitxor (ctsr(21) ,keyb) ; 
'/, clock the ciphertext shift-register 
ctsr = [ctO ctsr(l:20) mO ctsr(22:30)] ; 
end 
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C Vulcan Decrypt Simulation 

t 

'/, Vulcan decryption simulation 
% 2014-06-04 — CJR 

'/, inputs: 128-bit SRAM array contents "sram" 
'/, 8-bit CV shift register contents "cv8" 

'/, n-bit ciphertext "cti" 

'/, outputs: n-bit plaintext "pto" 

'/, > first 31 bits of plaintext will be gibberish 

decrypts ciphertext into plaintext using Vulcan cipher 
'/, requires "key schedule" to have been run prior to use 
% 

'/, check user-supplied inputs for simple errors 
if ((exist ('sram') == 0) I I (length(sram) != 128)) 

error ("128-bit SRAM array not found — run key schedule") 
end 

if ((exist('cv8') == 0) I I (length(cv8) != 8)) 

error ("8-bit CV shift register not found — run key schedule") 
end 

if (exist ('cti') == 0) 

error("ciphertext input not found — create some ciphertext") 
end 

7, set up required variables 

last = 0; '/, last ciphertext input bit for differential decoder 

ctsr = zeros(l,31); "/, 31-bit ciphertext shift-register 

pto = zeros (1 , length(cti) ) ; '/, pre-allocate plaintext output 

'/, process all bits of ciphertext input 

for ii = 1 : length(cti) 

'/, differentially decode the ciphertext input bit 

ctO = bitxor(cti(ii) ,last) ; 

last = cti(ii) ; 

'/, compute the current SRAM address 
addr = ctsr(l :7) ; 
addr = addr* [1 2 4 8 16 32 64] ' ; 
addr = addr+1; 

'/, combine SRAM bit with CT21 
keyb = sram(addr); 
mO = bitxor (ctsr(21) ,keyb) ; 
'/, compute the X0R tree results 
pt = ctO; 

pt = bitxor (pt,bitand(cv8(l) ,ctsr(22))) ; 
pt = bitxor (pt,bitand(cv8(2) ,ctsr(23))) ; 
pt = bitxor (pt,bitand(cv8(3) ,ctsr(24))) ; 
pt = bitxor (pt,bitand(cv8(4) ,ctsr(25))) ; 
pt = bitxor (pt,bitand(cv8(5) ,ctsr(26))) ; 
pt = bitxor (pt,bitand(cv8(6) ,ctsr(27))) ; 
pt = bitxor (pt,bitand(cv8(7) ,ctsr(28))) ; 
pt = bitxor (pt,bitand(cv8(8) ,ctsr(29))) ; 
pt = bitxor (pt , ctsr (30) ) ; 
'/, save decrypted plaintext 
pto(ii) = pt; 

clock the ciphertext shift-register 
ctsr = [ctO ctsr(l:20) mO ctsr(22:30)] ; 
end 
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D Vulcan Crypt analysis Simulation 


% 

'/, Vulcan cryptanalysis simulation 

% 2014-07-15 — CJR 

% input: n-bit ciphertext "ct" 

°/ e output: 71-bit cryptovariable "cv" 

recovers Vulcan CV from ciphertext assuming all-0 plaintext 
t 

% check user-supplied inputs for simple errors 
if (exist ('ct') == 0) 

error ( "ciphertext not found — create some ciphertext") 
end 

'/, table of 128-bit SRAM contents in terms of 64 CV bits (of 71-bit user CV) 

'/, each row represents the contents of the corresponding SRAM address from 000 to 127 

Z the columns are user CV bits v70 v69 v68 v67 . . . vlO v09 v08 v05 

'/, (note that rows containing more than a single 1 represent parity bits) 

'/, (note that user CV bits v07 v06 v04 v03 v02 vOl vOO are NOT stored in SRAM) 

sr = [. . . 
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'/, table of all 128 possible values of 8-bit CV shift register 


cs = 

[... 















255, 

254, 

253, 

252, 

251, 

250, 

249, 

248, 

247, 

246, 

245, 

244, 

243, 

242, 

241, 

015, 

239, 

238, 

237, 

236, 

235, 

234, 

233, 

023, 

231, 

230, 

229, 

027, 

227, 

029, 

030, 

031, 

223, 

222, 

221, 

220, 

219, 

218, 

217, 

039, 

215, 

214, 

213, 

043, 

211, 

045, 

046, 

047, 

207, 

206, 

205, 

051, 

203, 

053, 

054, 

055, 

199, 

057, 

058, 

059, 

060, 

061, 

062, 

063, 

191, 

190, 

189, 

188, 

187, 

186, 

185, 

071, 

183, 

182, 

181, 

075, 

179, 

077, 

078, 

079, 

175, 

174, 

173, 

083, 

171, 

085, 

086, 

087, 

167, 

089, 

090, 

091, 

092, 

093, 

094, 

095, 

159, 

158, 

157, 

099, 

155, 

101, 

102, 

103, 

151, 

105, 

106, 

107, 

108, 

109, 

110, 

111, 

143, 

113, 

114, 

115, 

116, 

117, 

118, 

119, 

120, 

121, 

122, 

123, 

124, 

125, 

126, 

127, 
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]; 

'/, differentially decode the ciphertext prior to processing 

ctd = abs(diff (ct)) ; 

% set up initial conditions 

solved = 0; '/, no solution 

outernotdone = 1; '/, loop flag 

ii = 1; CV shift register table index 

while (outernotdone) 

'/, get 8-bit CV shift register candidate from table & convert to binary 

v = dec2bin(cs(ii) ,8) ; 

cv8 = toascii(v)-48; 

'/„ set up new blank solution 

qqq = zeros (64 , 65) ; '/„ augmented solution matrix 

rrr = zeros(64,l); '/, vector of matrix rows that have been filled 
innernotdone = 1 ; 

nn = 32; '/, index of ciphertext bit 
while (innernotdone) 
'/, form SRAM addresses 

al = ctd(nn-8:nn-2)*[64 32 16 8 4 2 1]'; 
a2 = ctd(nn-9:nn-3)*[64 32 16 8 4 2 1]'; 
a3 = ctd(nn-10:nn-4)*[64 32 16 8 4 2 1] ' ; 
a4 = ctd(nn-ll:nn-5)*[64 32 16 8 4 2 1] ' ; 
a5 = ctd(nn-12:nn-6)*[64 32 16 8 4 2 1] ' ; 
a6 = ctd(nn-13:nn-7)*[64 32 16 8 4 2 1] ' ; 
a7 = ctd(nn-14:nn-8)*[64 32 16 8 4 2 1] ' ; 
a8 = ctd(nn-15:nn-9)*[64 32 16 8 4 2 1] ' ; 
a9 = ctd(nn-16:nn-10)*[64 32 16 8 4 2 1]'; 
% get SRAM content vectors 
vl = sr(al+l, :) ; 
v2 = sr(a2+l, :) ; 
v3 = sr(a3+l, :) ; 
v4 = sr(a4+l, :) ; 
v5 = sr (a5+l , : ) ; 
v6 = sr(a6+l, :) ; 
v7 = sr (a7+l , : ) ; 
v8 = sr(a8+l, :) ; 
v9 = sr(a9+l, :) ; 

'/, build left side of linear equation describing this ciphertext bit 
vv = zeros (1 , 64) ; 

vv = bitxor(vv,bitand(cv8(l) ,vl)) ; 
vv = bitxor(vv,bitand(cv8(2) ,v2)) ; 
vv = bitxor(vv,bitand(cv8(3) ,v3)) ; 
vv = bitxor(vv,bitand(cv8(4) ,v4)) ; 
vv = bitxor(vv,bitand(cv8(5) ,v5)) ; 
vv = bitxor(vv,bitand(cv8(6) ,v6)) ; 
vv = bitxor(vv,bitand(cv8(7) ,v7)) ; 
vv = bitxor(vv,bitand(cv8(8) ,v8)) ; 
vv = bitxor(vv,v9) ; 

'/, build right side of linear equation describing this ciphertext bit 

7, i.e. calculate resulting keystream bit (assuming plaintext was 0) 

c = ctd(nn) ; '/, (if plaintext was NOT 0, XOR the known plaintext bit here) 

c = bitxor(c,bitand(cv8(l) , ctd(nn-22) ) ) ; 

c = bitxor(c,bitand(cv8(2) , ctd(nn-23) ) ) ; 

c = bitxor(c,bitand(cv8(3) , ctd(nn-24) ) ) ; 

c = bitxor (c ,bitand(cv8(4) , ctd(nn-25) ) ) ; 

c = bitxor (c ,bitand(cv8(5) , ctd(nn-26) )) ; 

c = bitxor(c,bitand(cv8(6) , ctd(nn-27) ) ) ; 
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c = bitxor(c,bitand(cv8(7) , ctd(nn-28) ) ) ; 
c = bitxor(c,bitand(cv8(8) , ctd(nn-29) ) ) ; 
c = bitxor (c , ctd(nn-30) ) ; 
'/, build the overall equation 
qq = [vv,c] ; 
notdone = 1 ; 

'/, put the linear equation into the augmented solution matrix 
while (notdone) 

cc = f ind(qq==l , 1) ; "/, column of leftmost 1 in candidate 
if (cc==65) '/, this is an inconsistent solution 
ii = ii + 1; '/, try next CV shift register value 

break out of inner loop 
innernotdone = 0; 
break; 
end 

if ( ! isempty (cc) ) '/, vector was not all 0s 

if(rrr(cc)) '/, this row already exists in the matrix 

qq = bitxor(qq, qqq(cc,:)); 
else '/, this row does not exist yet 

qqq(cc,:) = qq; "/, save it in the matrix 

rrr(cc) =1; "/, show this row now full 

notdone = 0; '/, break out of vector loop 
end 

else % vector was all 0s and is thus of no use to us 

notdone = 0; '/, break out of vector loop 
end 
end 

if (sum(rrr)==64) '/, have we filled the entire solution matrix 

innernotdone = 0; '/, we are done 

outernotdone = 0; 

solved = 1; we have a solution 
end 

nn = nn + 1; '/, move on to next ciphertext bit 
if (nn>length(ctd) ) "/, have we run out of ciphertext 
innernotdone = 0; '/, we are done 
outernotdone = 0; 
end 
end 
end 

if (solved) '/, we have a valid & complete solution matrix 
put the solution matrix in reduced row echelon form 
for ii = 64:-l:2 '/, work up from bottom row to top row 
qq = qqq(ii,:); '/, get row 

for jj = ii-l:-l:l "/, check all rows above this one 
if (qqq(j j , ii)==l) '/, target row has a 1 in our column 

qqq(jj,:) = bitxor (qqq(jj ,:) ,qq) ; '/, X0R it out of there 
end 
end 
end 

'/, form & print the final answer 

'/. right-most column of solution matrix holds CV bits 70 . 69 . 68 . 67 . . . 10 . 09 . 08 . 05 
'/. cv8 holds CV bits X. 01 .00.04.03.02.07.06, bits inverted if bin2dec(cv8) > 127 
tmp = qqq( : ,65) ' ; 

if(cv8*[128 64 32 16 8 4 2 1]'>127) '/. invert cv8 if necessary 

cv8 = bitxor(cv8,ones(l,8)) ; 
end 

cv = [tmp (1:63) cv8(7:8) tmp (64) cv8(4:6) cv8(2:3)]; '/„ recovered CV 
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printf ("recovery complete\n" ) ; 
printf ("CV = ") ; 
printf ("°/,d" , cv) ; 
printf ("\n" ) ; 
else 

printf ("full solution not found — try longer ciphertext input \n"); 
end 
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E DVP Key Loader Firmware Disassembly 
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PIA 
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clrb 


F15A 

96 

4C 


" L" 

ldaa 

$004C 

F15C 

88 

02 


11 11 

eora 

#$02 

F15E 

97 

82 


11 11 

staa 

PB 

F160 

97 

4C 


" L" 

staa 

$004C 

F162 

CI 

OE 


n n 

cmpb 

#$0E 

F164 

27 

03 


n ; n 

beq 

$F169 


46 


F166 

5C 



ii \ ii 

\ 



F167 

20 

F9 


ii ii 

bra^ 

$F162 

F169 

D6 

66 


„ f „ 

ldab 

$0066 

T71 RR 
r IDE 

pi 

L>1 

OA 

OU 


n ii 

cmpb 

#!pOU 

T71 fin 
r lOD 

ZD 

T?7 


ii g. ii 

bne 

<tT71 RR 

<j>r loo 

T71 RT7 
r lor 

RQ 

oy 



II Q II 

y 

r"ts 


r 1 f U 


no 

o 1 

ii n " 

1Q.X 

fflpUUO 1 

rlio 

OD 

R7 
0 1 


g" 

Id. a. a. 

J*<t!R7 
WipO / 

r 1 ( o 

Q7 

y f 

OA 

OU 



staa 

D A 

riff 

pr 

r jj 



iQaD 

#ipr JJ 

T71 7Q 

r 1 f y 

U f 

RO 
OZ 


ii ii 

stab 

DP 

T71 7R 

r 1 f d 

PR 
L«D 

A7 
*± f 


ii n ii 

laau 

#ip4 / 

r 1 f D 

n7 

U f 

OA 

o(J 



stab 

D A 
rA 

T71 7T7 

r 1 f r 

Q7 

y f 

RO 


„ „ 

staa 

D A 
rA 

T71 R 1 

r lOl 

A R 

no 



ldaa 

$00 , x 

"P1 R3 
r loo 

RA 

07 
U 1 



anda 

#$07 

T71 Rt; 
r loo 

OA 

on 
zu 


ii ii 

oraa 

ffipzU 

r lo f 

Q7 

y f 

OA 

OU 


ii ii 

staa 

D A 
rA 

T71 RQ 

r ioy 

PR 

r.D 

no 
uu 



laau 

$00 , x 

T7H OR 

r IoJd 

D4 



II T» 
1 

isru 


F18C 

C4 

FD 




#$FD 

F18E 

CA 

01 



orab 

#$01 

F190 

D7 

82 


" " 

stab 

PB 

r isz 

£51 

PT7 

Or 



anda 

#4; pp 

r 134 

Q7 

y f 

OA 

OU 



staa 

D A 
rA 

F196 

8A 

20 


„ „ 

oraa 

#$20 

F198 

97 

80 



staa 

PA 

F19A 

08 



II tt 

inx 


F19B 

8C 

00 

59 

" Y" 

cpx 

#$0059 

r lyt 

OR 
ZD 

111 


II 0. II 

(L 

bne 

<tT71 R1 
ipr lOl 

F1A0 

D7 

4C 


ii l" 

stab 


T71 AO 

r lAz 

RR 
OO 

Ho 



ldaa 


T71 AA 

r 1A4 

nR 

DO 

R7 
0 f 


S 

laau 

q>uuo f 

F1A6 

2A 

02 


»* " 

bpl 

$F1AA 

F1A8 

84 

FD 


ii ii 

anda 

#$FD 

T7H ft A 

r 1AA 

Q7 

y f 

ATI 


II vtl 

staa 

<fcf*lfiAR 

F1AC 

97 

RO 
OU 



staa 

PA 

F1AE 

39 



"9" 

rts 


T71 AT7 

r lAr 

PC 

T7T7 

r r 

7f 

f n. 

II ~ II 

ldx 

ffEpr r it 

F1B2 

4D 



"M" 

tsta 


F1B3 

27 

04 


II ; II 

beq 

$F1B9 

F1B5 

08 



II tt 

inx 


F1B6 

4A 



"j" 

deca 


F1B7 

20 

F9 


II II 

bra 

$F1B2 

F1B9 

A6 

00 


II II 

ldaa 

$00, x 

F1BB 

DE 

63 


" C " 

ldx 

$0063 

F1BD 

A7 

00 


II II 

staa 

$00, x 

F1BF 

39 



"9" 

rts 


F1C0 

9F 

63 


ii c „ 

sts 

$0063 


write buffer 51.59 to display 
enable display 

drop dsp write 
raise dsp write 

get byte from table 

save to display 
get same byte 
move as required 

save to display 

display write 

done with 8 chars? 

4C <- last char 
a <- 227 
b <- (67) 


numbers table 
a is octal digit 

inc table index until digit found 

we have correct index of digit char 
save digit in display buffer 

load characters from table to 51.59 


47 


T71 HO 

r l\jZ 

OD 



"5" 

txs 



pr 

UU 



ldx 

ffipUUol 

r 1L/D 

QQ 
OO 



II <3 II 

O 

. . . 

pulb 


F1C7 

E7 

00 



stab 

$00 , x 

F1C9 

08 




inx 


F1CA 

8C 

00 

59 

ii y" 

cpx 

#$0059 

F1CD 

26 

F7 


"& " 

bne 

$r 10b 

F1CF 

9E 

63 


,1 c „ 

Ids 

$0063 

F1D1 

39 



"9" 

rts 


F1D2 

B6 

01 

C8 


ldaa 

$01C8 

r ILJo 


no 
Uo 


ii ii 

and a 

TftpUo 

F1D7 

27 

12 



beq 

$r lht> 

F1D9 

CE 

FF 

B3 

ii ii 

ldx 

#$FFB3 

F1DC 

DF 

61 


" a" 

stx 

$0061 

FIDE 

BD 

Fl 

CO 

II II 

jsr 

$F1C0 

F1E1 

86 

80 


II II 

ldaa 

#$80 

F1E3 

97 

56 


II 

staa 

$Uubo 

F1E5 

86 

01 



ldaa 

#$01 

F1E7 

97 

72 


II r ll 

staa 

$0072 

F1E9 

20 

23 


II £11 

bra 

$r zUh 

F1EB 

BD 

FE 

51 

" Q" 

jsr 

$FE51 

F1EE 

AO 

UU 


ii ii 

ldaa 

ipUU , x 

FIFO 

27 

05 



beq 

$F1F7 

F1F2 

CE 

FF 

96 

ii ii 

ldx 

#$FF96 

F1F5 

20 

03 



bra 

$F1FA 

F1F7 

CE 

FF 

8E 

I. .. 

ldx 

#$FF8E 

FIFA 

BD 

Fl 

CO 


jsr 

$r 1CU 

F1FD 

86 

80 



ldaa 

#$80 

T71 T7T7 
r Irr 

Q7 

O 1 


ti n » 

staa 

ipUUOl 

r zU 1 

DO 

Ul 

17 TT 

r ti 


ldaa 

q>U lr ti 

F204 

84 

07 



and a 

#$07 

F206 

CE 

00 

52 

" R" 

ldx 

#$0052 

F209 

DF 

63 


ii C n 

stx 

ipUubo 

F20B 

BD 

Fl 

AF 


jsr 

$F1AF 

r zUCi 

D U 

TP 1 

r 1 

1 u 

ii ii 
P 

jsr 

<j>r 1 / U 

T701 1 

OQ 

oy 



II o " 

rts 


F212 

96 

68 


" h" 

ldaa 

$0068 

F214 

2B 

34 


„ +4 „ 

bmi 

$F24A 

F216 

D6 

6B 


" k" 

ldab 

$006B 

F218 

CI 

04 



cmpb 

#$04 

F21A 

27 

2A 


" ' *" 

beq 

$F246 

F21C 

F6 

01 

C8 


ldab 

$01C8 

F21F 

C4 

08 



andb 

#$08 

F221 

26 

23 


"&#" 

bne 

$F246 

F223 

D6 

6B 


,i k „ 

ldab 

$006B 

F225 

27 

13 



beq 

$F23A 

F227 

CI 

03 



cmpb 

#$03 

F229 

27 

4A 


,,, ji, 

beq 

$F275 

F22B 

39 



"9" 

rts 



a <- key# 
Loc? 

put table chars in buffer 
56 <- 128 
72 <- 1 

x <- Ic0.1c7 based on key# 
ready- 
All Erased 

put table chars in buffer 

get a byte from RAM 
keep only octal digit 
point to display buffer 

convert oct to char 

write buffer to display 
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F22C 

CE 

FF 

9D 

II II 

ldx 

#$FF9D 

Load 

F22F 

BD 

Fl 

CO 

II II 

J sr 

$F1C0 

put table chars in buffer 

F232 

BD 

Fl 


II _ II 
P 

jsr 

$F170 

write buffer to display 

F235 

C6 

07 


II II 

ldab 

#$07 


F237 

D7 

69 


" i" 

stab 

$0069 


r zoy 

oy 



II Q II 

r"ts 



F23A 

85 

08 


ii ii 

bita 

#$08 


F23C 

27 

U 1 


II ; II 

beq 

$F23F 


r zoEi 

oy 



II Q II 

y 

r"ts 



T70QT7 
r Zor 

D ( 

Ul 

r Hi 

ii ii 

staa 

q>U lr ti 



r>iJ 

r 1 

UZ 

ii ii 

jsr 

<btrl no 


F245 

39 



"9" 

rts 





r JJ 


II II 

jsr 

ipr URr 


F249 

39 



ngii 




F24A 

CE 

F2 

5D 

" ]" 

ldx 

#$F25D 


F24D 

84 

7F 


ii ii 

anda 

#$7F 


F24F 

27 

06 


II ; II 

beq 

$F257 


F251 

08 



II tt 

inx 



F252 

08 



II tt 

inx 



F253 

08 



II tt 

inx 



F254 

4A 



"j" 

deca 



F255 

20 

F8 


II II 

bra 

$F24F 


F257 

AD 

00 


II II 

jsr 

$00, x 


F259 

BD 

Fl 

70 

" P " 

jsr 

$F170 

write buffer to display 

F25C 

39 



"9" 

rts 



F25D 

7E 

F3 

B5 


jmp 

$F3B5 


F260 

7E 

F4 

65 

n- e ii 

jmp 

$F465 


F263 

7E 

F4 

C5 


jmp 

$F4C5 


F266 

7E 

F3 

57 

»- w" 

jmp 

$F357 


F269 

7E 

F5 

7B 

II- { „ 

jmp 

$F57B 


F26C 

7E 

F5 

9E 


jmp 

$F59E 

! keyload ! 

F26F 

7E 

F3 

68 

II- h „ 

jmp 

$F368 


F272 

7E 

F3 

7C 

II- l„ 

jmp 

$F37C 



F275 

96 

6E 


ii n ii 

ldaa 

$006E 

F277 

26 

1A 


"& " 

bne 

$F293 

F279 

96 

68 


" h" 

ldaa 

$0068 

F27B 

85 

08 



bita 

#$08 

F27D 

27 

01 



beq 

$F280 

F27F 

39 



"9" 

rts 


F280 

7F 

00 

00 

ii n 

clr 

$0000 

F283 

7F 

00 

01 

ii n 

clr 

$0001 


49 


F286 

B7 

01 

FE 

ii ii 

staa 

$01FE 

F289 

CE 

00 

02 

ii ii 

ldx 

#$0002 

F28C 

DF 

4D 


ii j^n 

stx 

<1>A A A T\ 

q>UU4D 

F28E 

7F 

00 

6A 

„ j.i 

clr 

ipUUbA 

F291 

20 

0D 



bra 

<t>T70 A A 

q>r zAU 

F293 

96 

6E 


ii n ii 

ldaa 

ipOUbh 

F295 

91 

6F 


II qII 

cmpa 

<1>A ACT 

q>UUbr 

F297 

26 

01 


"& " 

bne 

q>r z»A 

F299 

39 



"9" 

rts 


F29A 

96 

69 


II j_ ** 

ldaa 

$0069 


yi 

7A 

( u 


II —II 

p 

cmpa 

<bA A"7A 

q>UU / U 

F29E 

26 

12 


"& " 

bne 

d> 170130 

ipr zbz 

F2A0 

BD 

FE 

CD 


jsr 

Arr /*rr\ 

q>r ECD 

F2A3 

7C 

00 

6A 

II 1 -i II 

inc 

ifcUubA 

F2A6 

96 

6A 


" j" 

ldaa 

<bA AC A 

q>UUoA 

TO A Q 
r ZAo 

no 
Uo 



II tt 

inx 


F2A9 

DF 

63 


II c ll 

stx 

<tA AC O 

F2AB 

BD 

Fl 

AF 


jsr 

$F1AF 

F2AE 

86 

02 



ldaa 

#$02 

F2B0 

97 

69 


II .£11 

staa 

d>A ACQ 

q>UUby 

F2B2 

96 

6E 



* ^ ' 

<bAACT 

F2B4 

27 

IB 


II, „ 

beq 

$F2D1 

F2B6 

DE 

4D 


" M" 

ldx 

$004D 

F2B8 

96 

68 


ii 

ldaa 

q>00bo 

F2BA 

A7 

00 



staa 

$00 , x 


AQ 




inx 


F2BD 

DF 

4D 


ii j^ii 

stx 

itAA/in 
ipU(J4D 

F2BF 

BD 

FE 

60 

" „ " 

jsr 

q>r hbO 

TOPO 

r zuz 

fit 
Ur 

Do 


c 

stx 

<fcAACO 

F2C4 

96 

68 


II 

ldaa 

<fcA AC Q 

F2C6 

BD 

Fl 

AF 


jsr 

$F1AF 

F2C9 

96 

67 


.1 g.l 

ldaa 

<1>A AC7 

q>UUb ( 

TOPB 


nn 
ou 



and a 

tbr'A 
TftpUU 

F2CD 

81 

80 



cmpa 

#$80 

F2CF 

27 

4D 


II J J^ll 

beq 


TOTH 

BD 

FF 


II II 

jsr 

<fcTTAl"\ 

F2D4 

96 

6E 


II n ll 

ldaa 

<t A ACT 

ipUubh 

F2D6 

91 

6F 


II q M 

cmpa 

<1>A ACT 

ipUubr 

F2D8 

26 

37 


"&7" 

bne 

$F311 

F2DA 

96 

6A 


,i j,. 

ldaa 

$006A 

F2DC 

81 

04 



cmpa 

#$04 

F2DE 

26 

31 


"&1" 

bne 

$F311 

F2E0 

96 

67 


" g" 

ldaa 

$0067 

F2E2 

84 

CO 



and a 

#$co 

F2E4 

81 

CO 



cmpa 

#$co 

F2E6 

26 

OC 


"& " 

bne 

$F2F4 

F2E8 

96 

54 


,, T ,i 

ldaa 

$0054 

F2EA 

84 

7F 



and a 

#$7F 

F2EC 

97 

54 


,, T „ 

staa 

$0054 

F2EE 

86 

80 



ldaa 

#$80 

F2F0 

97 

55 


,1 yii 

staa 

$0055 

F2F2 

20 

ID 



bra 

$F311 


50 


convert oct to char 


convert oct to char 


F2F4 

96 

68 


" h" 

ldaa 

$0068 

F2F6 

84 

04 


11 11 


#$04 

F2F8 

27 

11 


11 ; 11 

beq 

$F30B 

F2FA 

7A 

00 

6E 

"z n" 

dec 

$006E 

F2FD 

7A 

00 

69 

II z ^11 

dec 

$0069 

F300 

DE 

4D 


ii M " 

ldx 

$004D 

F302 

09 



ii tt 

dex 


F303 

DF 

4D 


ii 


*004D 

F305 

86 

CF 


ii ii 

ldaa 

#$CF 

F307 

97 

58 


ii £ii 


<J>\J\JDO 

F309 

20 

06 


ii ii 

bra 

$F311 

F30B 

96 

58 


" X" 

ldaa 

$0058 

F30D 

84 

7F 


ii ii 

anda 

#$7F 

F30F 

97 

58 


" X" 

staa 

$0058 

F311 

BD 

Fl 

70 

" p" 

j sr 

$F170 

F314 

96 

6E 


" n" 

ldaa 

$006E 

F316 

81 

01 


11 11 

cmpa 

#$01 

F318 

26 

03 


"ft " 

bne 

$F31D 

F31A 

7A 

00 

69 

"z i" 

dec 

$0069 

F31D 

39 



"9" 

rts 


F31E 

96 

6E 


ii n ii 

ldaa 

$006E 

F320 

84 

01 


" " 

anda 

#$01 

F322 

26 

14 


"ft " 

bne 

$F338 

F324 

BD 

FE 

OD 

11 II 

J sr 

$FE0D 

F327 

D6 

00 



ldab 

*noon 

F329 

C4 

01 



andb 

#$01 

F32B 

26 

15 


"& " 


$F342 

F32D 

DE 

4D 


» M " 

ldx 

$004D 

F32F 

09 



ii tt 

dex 


F330 

DF 

4D 


» M " 

stx 

$004D 

F332 

96 

01 


" " 

ldaa 

$0001 

F334 

97 

00 


" " 

staa 

$0000 

F336 

20 

0D 


" " 

bra 

$F345 

F338 

7F 

00 

00 

n n 

clr 

$0000 

F33B 

BD 

FE 

OD 

ii n 

J sr 

$FE0D 

F33E 

96 

00 


n n 


$0000 

vP \J W W \J 

F340 

97 

01 


n n 

staa 

$0001 

F342 

BD 

FF 

OD 

n n 

j sr 

$FF0D 

F345 

96 

6E 


n n ii 

ldaa 

$006E 

F347 

91 

6F 


n Q n 

cmpa 

$006F 

F349 

26 

C6 


"& " 

bne 

$F311 

F34B 

96 

56 


„ v „ 

ldaa 

$0056 

F34D 

84 

7F 



anda 

#$7F 

F34F 

97 

56 


" V" 

staa 

$0056 

F351 

86 

80 



ldaa 

#$80 

F353 

97 

57 


" W" 

staa 

$0057 

F355 

20 

BA 



bra 

$F311 

F357 

B6 

01 

C8 

n n 

ldaa 

$01C8 


write buffer to display 


51 


F35A 

84 

08 




#$08 

F35C 

9A 

6B 



oraa 


r ooEj 

ZD 

n7 


ti p. ti 

one 


r ooU 

Oft 

oo 

Uo 



j.ciaa 


F362 

97 

6B 


" k" 

staa 

$006B 

F364 

BD 

F2 

2C 

II II 

jsr 

$F22C 

F367 

39 



"9" 

rts 


r oOO 




tin ii 

u 

clra 


r oby 

Q7 

y f 

fr 


ii n ii 
u 

staa 

<fcpipi/t t? 

r ODD 

Q7 
y f 

RO 

ou 


II pn 

staa 

$uuou 

F36D 

96 

68 


" h" 

ldaa 

$0068 

F36F 

81 

87 


ii ii 

cmpa 

#$87 

roil 

07 
Z ( 

no 
Uo 



beq 


T7'37'3 

DO 

Ul 


ii ii 

ldaa 

<fcpi 1 pq 

roiD 

of 

FD 


ii ii 

and. a 

#$FD 

"P"378 
roiO 

R7 

U 1 

OO 

ii ii 

staa 


roiD 

o3 



HQ 'I 

y 

rts 


F37C 

B6 

01 

C8 

ii ii 

ldaa 

$01C8 

T7Q7T7 

r o / r 

(5/1 

no 
Uo 


ii ii 

and a 

#$08 

F381 

9A 

6B 


" k" 

oraa 

$006B 

F383 

27 

01 


II ; II 

beq 

$F386 

r ooo 

oy 



II Q II 

y 

rts 


r oOD 

Rfi 
DO 

U 1 


II II 

ldaa 


F389 

84 

04 


II II 


#$04 

F38B 

07 
Z ( 

uy 


,, ; ,, 

beq 

q>r oyo 

F38D 

86 

06 


II II 

ldaa 

#$06 

F38F 

B7 

01 

C8 

II II 

staa 

$01C8 

T7QQO 

D u 

TP 1 

r 1 

no 

JJZ 

II II 

jsr 

*T71 no 

F395 

39 



"9" 



F396 

4F 



"0" 

clra 


T7QQ7 
r OS ( 


U 1 


ii ii 

J.C1X 

# tJ>U 1UU 

T7*5Q A 

A A 

nn 


ii ii 

oraa 

$00 , x 

■p"3Qf 
r o3 Li 

of 

ur 


ii ii 


#$0F 

F39E 

8C 

01 

C8 

ii ii 

cpx 

#$01C8 

F3A1 

27 

03 


II ; II 

beq 

$F3A6 

r 0A0 




II II 

inx 


F3A4 

20 

F4 


II II 


$F39A 

F3A6 

4D 



"M" 

tsta 


F3A7 

27 

01 


II ; II 

beq 

$F3AA 

F3A9 

39 



"9" 

rts 


F3AA 

7F 

00 

72 

" r " 

clr 

$0072 

F3AD 

86 

04 


n n 

ldaa 

#$04 

F3AF 

97 

6B 


" k" 

staa 

$006B 

F3B1 

BD 

FD 

AF 

II II 

j sr 

$FDAF 

F3B4 

39 



"9" 

rts 


F3B5 

96 

6B 


" k" 

ldaa 

$006B 

F3B7 

27 

2B 


">+" 

beq 

$F3E4 


52 


F3B9 

81 

04 


11 II 

cmpa 

#$04 




F3BB 

27 

4E 


II ) JJII 

eq 

$F40B 




F3BD 

Ol 

UO 


II II 

cmpa 

#$03 




r OCT 


uo 


II ; II 

beq 

ipr ooo 




r OL/1 

ol 



II II 

cmpa. 

ffvPU 1 




F3C3 

27 

22 


II ) it II 

beq 

$F3E7 




F3C5 

39 



"9" 

rts 





r OUD 

OR 

Oil 


II _ II 

n 

1 A -i a 

iciaa 

<tA ART 
■pUUOll 




r OOO 

ZD 

Ul 


II 0. II 

(L 

bne 

Jpr OUD 





OS 



y 






F3CB 

91 

6F 


., 0 .i 

cmpa 

$006F 




F3CD 

27 

IF 


II ; II 

beq 

$F3EE 




F3CF 

BD 

FE 

51 

» Q" 

jsr 

$FE51 

x <- IcO 

lc7 

based on key# 

F3D2 

6F 

00 


"o " 

clr 

$00, x 




r OLI^i 

15 u 

I* 11 

11 1 

II II 

jsr 

$r EitL I 

Do . 0*± ^. 

ram 

•nAA-r rt-F O/l ^-irT-i-t- 

aaar oi z*± aigit 

r ou i 

DE 

DO 


II -II 

c 

ldx 

*AACO 
$UUOO 




F3D9 

4F 



"0" 

clra 





r OLiii 

RT7 
Or 

nn 


II - ii 

0 

cir 

$00 , x 




r jUU 




II T II 

Li 

mca 





r ODD 

AO 

Uo 



ii tt 

inx 





r oUCi 

R 1 
ol 

lo 


ii ii 

cmpa 

ifip lO 




r OEiU 

OR 
ZD 

r O 


It 0. II 

(L 

bne 

<tT7"5n A 
ipr OJJA 




F3E2 

on 
zu 

ZU 


II II 

bra 

$F404 





7U 
/ El 

r 'i 

OA 

ou 

II ~ (-ill 

u 

jmp 

<pr 4oU 




F3E7 

BD 

FF 

4B 

" K" 

jsr 

$FF4B 




T7R"F A 

/ r 

uu 

Od 

II v II 

K. 

cir 

<fcAARR 
q>UUDl5 




r otJJ 

RQ 

oy 



II o ii 

y 

rts 





F3EE 

BD 

FE 

E7 


jsr 

$FEE7 

63.64 <- 

ram 

addr of 24-digit 

T7QT7 H 

r or 1 

OO 

1 Q 

lo 


ii ii 

ldaa 

■ft* 1 R 
TTEp lo 




r or O 


no 
uu 

AO 

uz 


lUX 

JttfcAAAO 




r or D 

DF 

D 1 


n n ii 
a 

S"tX 

<fcAAR1 
■pUUOl 




r Or o 


DO 


ii - ii 

c 

1 A-r 

lux 

<tAARR 

q>uuoo 




F3FA 

BD 

FF 

3C 

,. 

jsr 

$FF3C 




F3FD 

BD 

FE 

51 

" Q" 

jsr 

$FE51 

x <- IcO 

lc7 

based on key# 

TTAAA 
r f±UU 

RT7 
Or 

uu 


ii _ n 

0 

cir 

$00 , x 





RC 

Ob 

uu 


ii 1 ii 
i 

inc 

$00 , x 




T7A A/1 

BD 

FF 

o4 

II A II 

jsr 

<i>r r o^t 




F407 

BD 

Fl 

D2 


jsr 

$F1D2 




F40A 

39 



"9" 

rts 





F40B 

96 

72 


" r" 

ldaa 

$0072 




F40D 

84 

07 



anda 

#$07 




F40F 

81 

01 


II II 

cmpa 

#$01 




F411 

22 

01 


II II II 

bhi 

$F414 




F413 

39 



"9" 

rts 





F414 

86 

06 


II II 

ldaa 

#$06 




F416 

CE 

00 

02 

II II 

ldx 

#$0002 




F419 

DF 

61 


" a" 

stx 

$0061 




F41B 

CE 

01 

C9 

ii n 

ldx 

#$01C9 





■53 


F41E 

BD 

FF 

3C 

" <" 

jsr 

$FF3C 

F421 

OD 

OC 


II II 


#$0C 

r *±ZO 

uo 

1 z 


II -r II 

1 H aVi 
ludD 

3>uu / z 

F425 

F7 

01 

E0 

II II 

stab 

$01E0 

F428 

7F 

00 

72 

I, r .l 

clr 

$0079 


D I 

Ul 

PQ 
L/O 


staa 

<bn 1 pq 
q>U lL»o 



riA 

Uf 


II II 

bra 



DO 

Ul 

L.O 

II I. 

ldaa 

q>U IL-o 

r *±Oo 

P.ZL 

OP. 
Uo 


II II 

anda 

ffipUO 


Oft 
ZD 

Ul 


II 0. II 

fit 

bne 

!pr4oo 

"FAQ. 7 

oy 



II Q II 

y 

rts 


r loo 

QT7 

DO 


II r- " 
C 

S"tS 

q>uuDo 

■p/io A 
r 'ioii 

pu 
OEj 

U 1 

^O 

II II 

las 

ffipUlUO 

r 'ioJJ 


nn 
uu 

no 
uz 

II II 

lUX 

atfcnnno 

WipUUUZ 

F440 

33 



"3" 

pulb 


F441 

EO 

00 


II II 

subb 

$00, x 


PA 

Ur 


II II 

andb 


17 A AC 

OR 
ZD 

lo 


II 0. II 

fit 

bne 


T7AA7 

uo 



II tt 

inx 


F448 

8C 

00 

08 

II II 

cpx 

#$0008 

F44B 

26 

F3 


"& " 

bne 

$F440 

TTAAn 

yd 

DO 


II ^ II 

ICS 

■pUUDO 

T7AAT7 
r *±*±r 

r O 

Ul 

pn 


io.au 

<tn 1 pn 

r foZ 


U / 


II II 

andb 

#$07 

T7ACA 

U 1 

70 
f Z 


II —II 
i 

cmpb 

<fcnn70 

■J>UU / z 

r "iOD 

OR 
ZD 

nA 

Uf 


II 0. II 

fit 

bne 


r *±oo 

OD 

nA 


II II 

ldaa 

#$04 

F45A 

ZU 



II II 

bra 

$F428 

F45C 

9E 

63 


" c" 

Ids 

$0063 

F45E 

7F 

00 

72 

" r" 

clr 

$0072 

r *±o 1 

tan 

15 U 

r 1 

no 

II II 

jsr 

<bT7i no 
■pr luz 


oy 



II Q II 

y 

r"ts 


F465 

B6 

01 

C8 

ii ii 

ldaa 

$01C8 

r WO 

Oft 

no 
uo 



anda 


F46A 

26 

OC 


"& " 


$F478 

F46C 

96 

6B 


it j^ii 

lcT 

ipUUOB 

r ftOH 

z i 

no 
uo 


II ; II 

beq 

ipr ft f O 

F470 

81 

03 




#$03 

F472 

27 

18 



beq 

$F48C 

F474 

81 

04 



cmpa 

#$04 

F476 

27 

07 



beq 

$F47F 

F478 

BD 

FF 

34 

ii 4 " 

jsr 

$FF34 

F47B 

BD 

Fl 

D2 


jsr 

$F1D2 

F47E 

39 



"9" 

rts 


F47F 

D6 

72 


„ r „ 

ldab 

$0072 

F481 

CI 

01 


II II 

cmpb 

#$01 

F483 

27 

F3 


II ; II 

beq 

$F478 

F485 

7F 

00 

72 

" r" 

clr 

$0072 

F488 

BD 

FD 

AF 

II II 

jsr 

$FDAF 


■54 


F48B 

39 



ii g ii 

rts 



yo 

GT7 
OIL 


ii _ ii 
n 

Ida. a. 

ipUUOEi 

F48E 

26 

02 


"& " 

bne 

<t>T7/l rtO 

q>r4yz 

F490 

20 

E6 



bra 

$Mf O 

F492 

96 

69 


ii 

ldaa 

q>ouby 

F494 

81 

02 



cmpa 

#$02 

F496 

26 

07 


"ft " 

bne 

$F49F 

F498 

7F 

00 

6E 

ii n ii 

clr 

$006E 



r z 


ii ii 

jsr 

<fcl700f"* 

q>r ZZKj 

T7/I Of 

OQ 

jy 



II Q II 

y 

rts 


F49F 

D6 

69 


,, ± „ 

ldab 

$0069 

F4A1 

CO 

02 


ii ii 

subb 

#$02 

F4A3 

96 

6E 


ii n ii 

ldaa 

$006E 

F4A5 

10 




sba 


T7/I A £ 

y f 

CT7 
OIL 


n _ ii 
n 

staa 

q>UUoh 

T7/I A Q 

r ^Ao 

DL> 

17 17 

r r 

DO 

ii „ ii 
e 

jsr 

q>rr bo 

F4AB 

pu 

UU 

OO 

II Q ■■ 

b 

lax 

WEpUUOo 

F4AE 

86 

80 


II II 

ldaa 

#$80 

F4B0 

A7 

00 



staa 

$00 , x 

F4B2 

8C 

00 

58 

II ^11 

cpx 

#ipU0oo 

tare; 

07 
Z ( 

Uo 


II ; II 

beq 


F4B7 

08 



II tt 

inx 


F4B8 

20 

F6 


II II 

bra 

$F4B0 

F4BA 

flu 



II T " 

Li 

inca 


F4BB 

97 

53 


II gll 

staa 

ipUUbo 

F4BD 

BD 

Fl 

70 

" p" 

j sr 

$F170 

F4C0 

86 

02 


II II 

ldaa 

#$02 


y t 

by 


II J II 
1 

staa 

q>uut>y 





II o " 

y 

rts 


F4C5 

B6 

01 

C8 


ldaa 


F4C8 

84 

08 


ii ii 

anda 

#$08 

F4CA 

27 

01 


II ; II 

beq 

$F4CD 

F4CC 

39 



ngii 

rts 



yo 

CD 
DC 


ii i— II 

ldaa 

ipUUOD 

F4CF 

81 

04 



cmpa 

#$04 

r Qui. 

Oft 

Ul 


II 0. II 

bne 


F4D3 

39 



n g ii 

rts 


F4D4 

81 

03 



cmpa 

#$03 

F4D6 

27 

12 



beq 

$F4EA 

F4D8 

81 

01 



cmpa 

#$01 

F4DA 

26 

01 


"ft " 

bne 

$F4DD 

F4DC 

39 



„ 9 „ 

rts 


F4DD 

B6 

01 

FE 

ii ii 

ldaa 

$01FE 

F4E0 

4C 



"L" 

inca 


F4E1 

84 

07 


II II 

anda 

#$07 

F4E3 

B7 

01 

FE 

II II 

staa 

$01FE 

F4E6 

BD 

Fl 

D2 

II II 

j sr 

$F1D2 

F4E9 

39 



"9" 

rts 



■55 


F4EA 

96 

6E 


" n" 

ldaa 

$006E 

F4EC 

27 

05 


11 ; 11 

beq 

$F4F3 

F4EE 

91 

or 


II qII 


$UUDf 

r *±r U 

07 
Z 1 



11 ; 11 

beq 

<bT7t;nR 
q>r oud 

F4F2 

39 



"9" 

rts 


F4F3 

B6 

01 

FE 


ldaa 

$01FE 

F4F6 

4C 



"L" 

inca 


F4F7 

84 

07 
u / 


11 11 

anda 

#$07 

17AT7Q 

D7 
D ( 

U 1 


11 II 

staa 

<tn 1 TTR 

r 'ir L< 

Q7 

y / 

CO 

DO 


it u " 
11 

staa 

<tnn«p 
q>uuoo 

F4FE 

BD 

F2 

7R 

11 ..II 
u 

jsr 

•pr z / o 

r ou 1 

OD 

on 
OZ 


11 11 

ldaa 

j*4;ro 

ffpOZ 

r ouo 

Q7 
y f 

RR 
Do 


II Yl" 

staa 

ipUUDO 

r DUO 

RQ 

oy 



11 Q II 

y 

rts 


r duo 

Rn 

DU 

FE 


ii ii 

jsr 


r ouy 

yo 

C A 

DA 


ii j ii 
J 

ldaa 

<pUUDA 

F50B 

81 

04 


ii ii 

cmpa 

#$04 

RRnn 
r ouu 

OR 
ZD 

Uo 


II 0. II 

bne 

$r 0 1Z 

F50F 

7F 

00 

6A 

" j" 

clr 

$006A 

F512 

96 

6A 


" j" 

ldaa 

$006A 

F514 

4C 



"L" 

inca 


rolo 

Q7 

y i 

DA 


n ^ n 
J 

staa 

<fcnnfi a 

■pUUDA 

F517 

CE 

00 

52 

" R" 

ldx 

#$0052 

F51A 

DF 

63 


» c" 

stx 

$0063 

rolU 

Rn 

DU 

r 1 

A T7 
Ar 


jsr 

<tT71 AT7 

r D±r 

rh 

T7T7 
r r 

fie 
DO 

11 II 

e 

jsr 

$r r DO 

F522 

CP 

00 

OO 

11 Q II 

O 

ldx 

ffipUUClJ 

F525 

DF 

63 


II c 1l 


IJUUDO 

Trc:07 

DO 

D 1 


II —II 
g 

laaD 

<bnn«7 
q>uuo / 

r ozy 

OR 
ZD 

Uo 


11 _|_ 11 

bmi 

<pr DoU 

UCOD 

r OZD 


on 
uu 

do 

11 v 11 

A 

J.Q.X 

j*ttnnt;R 

ffvpUUOo 

r ozd 

on 

ZU 

UO 


11 11 

bra 

;j>r Ooo 

F530 

CE 

00 

56 

„ v „ 

ldx 

#$0056 

r Doo 

DF 

D 1 




CpUUD 1 

F535 

DE 

4D 


it j^ii 

ldx 

<fennzin 

F537 

A6 

00 



ldaa 

■ ■ 

$00, x 

F539 

BD 

Fl 

AF 

II II 

J sr 

$F1AF 

F53C 

9C 

61 


11 a ii 

cpx 

$0061 

F53E 

27 

14 



beq 

$F554 

F540 

08 



(I tt 

inx 


F541 

DF 

63 


II C 1I 

stx 

$0063 

F543 

DE 

4D 


" M " 

ldx 

$004D 

F545 

08 



ii ti 

inx 


F546 

DF 

4D 



stx 

$004D 

F548 

20 

ED 



bra 

$F537 

F54A 

A6 

00 



ldaa 

$00, x 

F54C 

84 

7F 



anda 

#$7F 

F54E 

A7 

00 



staa 

$00, x 

F550 

BD 

Fl 

70 

„ „ 

jsr 

$F170 


convert oct to char 


convert oct to char 


write buffer to display 


■56 


F553 

39 



ii g ii 

rts 


F554 

D6 

67 


" g" 

ldab 

q>Uub / 

F556 

C4 

CO 



andb 

#$C0 

F558 

CI 

CO 



cmpb 

#$C0 

F55A 

26 

EE 


"& " 

bne 

$F54A 

F55C 

86 

06 



ldaa 

#$06 

F55E 

97 

69 


ii ^ii 

staa 

q>UUby 

F560 

D6 

6A 


" j" 

ldab 

$006A 

F562 

CI 

04 



cmpb 

#$04 

F564 

26 

E4 


"& " 

bne 

$F54A 

F566 

86 

04 



ldaa 

#$04 

r boo 

y i 

by 


i 

staa 

q>UUby 

F56A 

C6 

80 



ldab 

#$80 

F56C 

D7 

55 


„ u„ 

stab 

$0055 

F56E 

D7 

56 


„ v „ 

stab 

$0056 

F570 

DE 

4D 


II J^ll 

ldx 

q>OU4D 

vol Z 

AO 

uy 



II It 

dex 


raid 

AO 

uy 



II tt 

dex 



DF 

A n 
*±u 


II M" 

n 

stx 

<tA C\A T\ 

F576 

CE 

00 

54 

" T" 

ldx 

#$0054 

F579 

20 

CF 


II II 

bra 

$F54A 

F57B 

B6 

01 

C8 


ldaa 

d>A -\ no 


ob 

no 


II II 

bita 

#$02 

F580 

27 

05 



beq 

$F587 

F582 

86 

oc 


II II 

ldaa 

#$oc 

F584 

B7 

01 

C8 

II II 

staa 

$01C8 

F587 

B6 

01 

DF 


ldaa 

q>01Ur 

F58A 

84 

OF 



and a 

#$0F 

r bob 

ol 

AT7 


II II 

cmpa 


F58E 

27 

03 


II ; II 

beq 

$F593 

F590 

7F 

01 

DF 

II II 

clr 

$01DF 

F593 

BD 

FE 

25 

II •/ M 

A 

jsr 


F596 

BD 

FE 

46 

II pn 

jsr 

ttrrc a a 
q>r hi4b 

F599 

86 

37 


" 7" 

ldaa 

#$37 

F59B 

97 

83 


II II 

staa 

CRB 

F59D 

39 



II Q II 

I"tS 


F59E 

B6 

01 

C8 


ldaa 

q>01Co 

T7C A 1 

r oAl 

(5/1 

Uo 


II II 

and a 

#$08 

F5A3 

9A 

6B 


II k ll 

oraa 

$006B 

F5A5 

27 

01 


II ; II 

beq 

$F5A8 

F5A7 

39 



"9" 

rts 


F5A8 

BD 

FE 

51 

" Q" 

J sr 

$FE51 

F5AB 

A6 

00 



ldaa 

$00, x 

F5AD 

26 

01 


"&. » 

bne 

$F5B0 

F5AF 

39 



"9" 

rts 


F5B0 

BD 

Fl 

D2 

II II 

J sr 

$F1D2 

F5B3 

BD 

FE 

E7 

II II 

J sr 

$FEE7 

F5B6 

96 

67 


" g" 

ldaa 

$0067 

F5B8 

2A 

03 


II ^ II 

bpl 

$F5BD 

F5BA 

7E 

F9 

1A 

II ~ II 

jmp 

$F91A 


! start of keyload! get key# 

check for valid key 

x <- 1C0.1C7 based on key# 
Tanother valid key check? 

display something 

63.64 <- ram addr of 24-digit key 

another check of some sort 


57 


F5BD 

7F 

00 

00 

II II 

clr 

$0000 

clear parity 

F5C0 

86 

15 


II II 

ldaa 

#$15 


F5C2 

97 

66 


„ f „ 

staa 

$0066 

66 <- 21 

F5C4 

DE 

63 


" c" 

ldx 

$0063 

63.64 holds key address 24 oct digits 

F5C6 

BD 

F7 

OA 

II II 

j sr 

$F70A 

get 1 digit of key & put in buffer 

F5C9 

08 



II tt 

inx 



F5CA 

7A 

00 

66 

"z f" 

dec 

$0066 


F5CD 

26 

F7 


"& " 


*F5rfi 

Tint" 1 e+ 01 Voir H "i crc: (fi'-t Vi"ii"c;l "in hn f f or 

F5CF 

C6 

01 


II II 

ldab 

#$01 


F5D1 

BD 

F7 

oc 

II II 

jsr 

$F70C 

t-m I- fiAi-h Voir "hi t" -in R 1 f 1 Til 
pUL D*± Oil Jicy U ± L ±11 Ol.OO \ -L U ) 

F5D4 

BD 

F7 

IE 

II II 

j sr 

$F71E 

put next 2 bits of 22nd dig in 65 (2b) 

F5D7 

BD 

F7 

IE 

II II 

j sr 

$F71E 


F5DA 

BD 

F7 

IB 

II II 

j sr 

$F71B 

put 23rd oct key digit in 65 (3b) 

F5DD 

BD 

F7 

IE 

II II 

j sr 

$F71E 


F5E0 

BD 

F7 

IE 

II II 

j sr 

$F71E 


F5E3 

BD 

F7 

IB 

II II 

J sr 

$F71B 

nut" 94--t-h nrt ~Vc\t Hi tri t" in fiR ( OY\~\ 

F5E6 

BD 

F7 

IE 

II II 

j sr 

$F71E 

65 now has 7 last bits of key 

F5E9 

74 

00 

65 

"t e" 

lsr 

$0065 

0 fill at msb / b has Is count 0.7 

F5EC 

CI 

03 


ii ii 

cmpb 

#$03 

more than 3 of 7 Is? 

F5EE 

2E 

03 


n n 

bgt 

$F5F3 


F5F0 

73 

00 

65 

"s e" 

com 

$0065 

fewer than 3 Is, invert all 8 bits 

F5F3 

C6 

40 


" 0" 

ldab 

#$40 

b <- 64 to clear out 59.60 

F5F5 

BD 

F7 

3F 

n 711 

J sr 

$F73F 

put 0 bit in 59.60 (clear parity reg) 

F5F8 

5A 



"Z" 

decb 



F5F9 

26 

FA 


"ft " 

bne 

$F5F5 


F5FB 

9F 

61 




$0061 

QSnro rirocont on 

F5FD 

C6 

40 


II g„ 

ldab 

#$40 

count 64 bits 

F5FF 

9E 

61 


" a" 

Ids 

$0061 

get saved sp 

F601 

96 

58 


" X" 

ldaa 

$0058 

get oldest bit from 51.58 

F603 

46 



"F" 

rora 


save as newest (rotate entire reg) 

F604 

BD 

F7 

26 

" &" 

j sr 

$F726 

put key bit in 51.58 

F607 

49 



n j 11 



\tcit.t +■ "in 1 qVi t*\~f a 
rvtjy U ± L. ±±1 ± o U \J -L d 

F608 

BD 

F7 

3F 

n 71. 

j sr 

$F73F 

put 0 in 59.60 & get oldest bit out 

F60B 

89 

00 


n 11 

adca 

#$00 

we are encoding key bits here 

F60D 

46 



"F" 

rora 


c <- k+p 

F60E 

24 

11 


"$ " 

bcc 

$F621 

k+p was 0 so shift only 

F610 

8E 

F9 

07 

11 n 

Ids 

#$F907 

tab:52009BFlED40EAC2 (bit was 1) 

F613 

CE 

00 

59 

" Y" 

ldx 

#$0059 


F616 

32 



"2" 

pula 


get byte from table 

F617 

A8 

00 


II II 

eora 

$00, x 

xor into 59.60 

F619 

A7 

00 


II II 

staa 

$00, x 

put taps from table into parity reg 

F61B 

08 



II tt 

inx 


next byte 

F61C 

8C 

00 

61 

II a l. 

cpx 

#$0061 

do 8 bytes (59.60) 

F61F 

26 

F5 


"& " 

bne 

$F616 


F621 

5A 



"Z" 

decb 


dec bit cnt 

F622 

26 

DB 


"& " 

bne 

$F5FF 

encode all 64 bits of key 

F624 

D6 

00 


II II 

ldab 

$0000 

get parity bit 

F626 

C4 

80 


II II 

andb 

#$80 


F628 

DA 

59 


„ Y „ 

orab 

$0059 


F62A 

D7 

59 


„ Y „ 

stab 

$0059 

save parity bit 3 msb of 59.60 


■58 


F62C 
F62F 


8E F8 E2 
CE 00 02 


Ids #$F8E2 
ldx #$0002 


tab : 8220D745D75AE75C086D6D7242440930D5404719 
x <- 2 (start) 


F632 

86 

OA 


11 II 


#$04 


F634 

97 

66 


„ f „ 

staa 

$0066 

66 <- 4 dibits per byte 

F636 

32 



"2" 

pula 


get table byte 

F637 

C6 

60 


II C II 

ldab 

#$60 

fill 02.50 with 18/58/98/D8 

F639 

46 




rora 


this probably sets up cti 

F63A 

56 



"V" 

rorb 


call these data bytes 

F63B 

46 



„p„ 

rora 


we fill 79 bytes here 

F63C 

56 



"V" 

rorb 


solely from lookup table 

F63D 

E7 

00 


II II 

stab 

$00, x 

1st 80 bits cti is in bit 6 (40) 

F63F 

08 



II tt 

inx 


next 56 bits cti is in bit 7 (80) 

F640 

8C 

00 

51 

" Q" 

cpx 

#$0051 

(end) 

F643 

27 

07 


II ) II 

beq 

$F64C 


F645 

7A 

00 

66 

"z f" 

dec 

$0066 


F648 

26 

ED 


"& " 

bne 

$F637 


F64A 

20 

E6 


II II 

bra 

$F632 


F64C 

9E 

61 


" a" 

Ids 

$0061 

get saved sp 

F64E 

86 

01 


II II 

ldaa 

#$01 


F650 

97 

73 


" s" 

staa 

$0073 

73 <- 01 (mask) 

F652 

CE 

00 

51 

" Q" 

ldx 

#$0051 


F655 

DF 

00 


n n 

stx 

$0000 

0 <- 0051 (end+1) 

F657 

CE 

F8 

F6 

,, ,. 

ldx 

#$F8F6 

tab : 7F9FD76197518306 

F65A 

DF 

63 


" c" 

stx 

$0063 

63 <- table 

F65C 

CE 

00 

16 

II „ 

ldx 

#$0016 

x <- 0016 (start) save to 16.50 

F65F 

BD 

F7 

58 

" X" 

j sr 

$F758 

encode key/par into 59 data bytes 

F662 

86 

02 



ldaa 

#$02 

1st 59 bytes k/p is in bit 0 (01) 

F664 

97 

73 


II gll 



7^ <- 09 (ma^k"! 

F666 

CE 

00 

47 

" G" 

ldx 

#$0047 


F669 

DF 

00 


II II 

stx 

$0000 

0 <- 0047 (end+1) save to 02.46 

F66B 

CE 

F8 

FE 


ldx 

#$F8FE 

tab : E3362921A745CC2A00 

F66E 

DF 

63 


II c ll 


*fiOR3 

DO s LdUle 

F670 

CE 

00 

02 


ldx 

#$0002 

x <- 0002 (start) 

F673 

BD 

F7 

58 

,1 x ,l 

j sr 

$F758 

encode key/par into 69 data bytes 

F676 

08 



II tt 

inx 


x <- 0048 (start) {we did 128b so far} 

F677 

C6 

08 


II II 

ldab 

#$08 

encode 8 leftover key bits from 65 








next 69 bytes k/p is in bit 1 (02) 

F679 

08 



I, tt 

inx 


save to 49.50 in bit 1 (02) 

F67A 

76 

00 

65 

"v e" 

ror 

$0065 

get key bit 

F67D 

24 

06 


"$ " 

bcc 

$F685 

note: we created 2 null bits above (inj 

F67F 

A6 

00 


ii ii 

ldaa 

$00, x 

get existing data byte 

F681 

8A 

02 


ii ii 

oraa 

#$02 

or in key bit 

F683 

A7 

00 


ii ii 

staa 

$00, x 

save new data byte 

F685 

5A 



"Z" 

decb 



F686 

26 

Fl 


"ft " 

bne 

$F679 


F688 

CE 

00 

02 


ldx 

#$0002 

x <- 0002 (start) 

F68B 

A6 

00 


II II 

ldaa 

$00, x 

move & rotate 22 data bytes 

F68D 

46 



"F" 

rora 


02.17 -> 51.66 

F68E 

A7 

4F 


» 0" 

staa 

$4F,x 


F690 

08 



II It 

inx 



F691 

8C 

00 

18 

II II 

cpx 

#$0018 

(end) 

F694 

26 

F5 


"& " 

bne 

$F68B 



■59 


r Db) D 

OD 

FO 



ldaa 

JttfcFO 
WipEiZ 


F698 

97 

80 


ii ii 

staa 

PA 


F69A 

86 

01 


ii ii 

aa 

#$01 


F69C 

97 

73 


ii ii 

* aa 

CpUU / o 

7^ <— 01 rVcnT-l 

F69E 

86 

40 


" ©" 

aa 

#$40 


F6A0 

97 

75 



s aa 

CpUU / D 

7^ AO ( f+- -i 

T7fi A O 


UU 

CI 
o 1 

ii n ■■ 

ldx 

TfEpUUo 1 


F6A5 

DF 

00 




*0000 


F6A7 

CE 

00 

00 

,, „ 

ldx 

#$0000 

x <- 0000 (start) 

F6AA 

BD 

F7 

8B 

ii ii 

jsr 

$F78B 

send key & cti to hybrid (81 bits) 

F6AD 

OD 

0.9 
UZ 



ldaa 

#$02 

we senT^ uu . ouct^i/ xd . DDKey 

T7fi AT7 

r DAr 

y f 

7Q 


s 

staa 

q>Uu / o 

7Q s no ^VrtTT^ 
/ o <- Uz i,Aey^ 

F6B1 

OD 

P.0 
OU 



ldaa 

ffvfOU 


F6B3 

97 

75 


ii U n 

staa 

$0075 

75 <- 80 (cti) 

F6B5 

CE 

00 

3A 

ii . ii 

ldx 

#$003A 


r OCO 

riF 
Ur 

no 



StX 

<fconno 
■puuuu 

n ^ — nn*5A ( ot,aa-\ \ 
u s uuofl i,eria+i^ 

F6BA 

CF 

oo 
uu 

oo 

UZ 

ii ii 

ldx 

JfiJOOOO 

■v <r" — nnno f cta-r+^ 
x v uuuz vsi^axT^ 

F6BD 

BD 

F7 

OD 

ii ii 

jsr 


send key & cti to hybrid (56 bits) 

F6C0 

A6 

00 


ii ii 


$00 x 

('OO'^Al up eprit 09 3Qrti/18 4Fkpv 

F6C2 

84 

80 


ii ii 

anda 
n 

#$80 



Z I 

no 
UZ 


,, ; „ 

beq 

q>r DL.O 


Ffiffi 

OD 

*±u 


" @" 

ldaa 

#$40 

ct i 

r DUO 

Ffi 

r.D 

ID 


11 11 

-LQ.au 

iplD ,X 

VUUDU^ 

F6CA 

C4 

02 


11 11 

andb 

#$02 


frit 1 

07 
Z ( 

no 

UZ 


,, , ,, 

beq 

3>r djju 



OA 
Oii 

on 
zu 



oraa 

jttfcon 

WEpZU 

key 

r OLiU 

OA 
Oii 

Uo 



oraa 

jttfcnp. 

ffipUO 

we - 

F6D2 

y ( 

QO 
OZ 


„ „ 

staa 

no 
rB 

send key & cti to hybrid (1 bit ) 


Ul 



11 tt 

nop 


we have now sent 138 bits total (1st 

r OLIO 

Ul 



11 tt 

nop 



r DUD 

op 
OO 

U^± 


11 11 

GOra 

#<fcnA 

toggle elk 

FfinP. 
r DUO 

Q7 

y i 

SO 
OZ 


11 11 

staa 

DD 
rD 


F6DA 

86 

F0 


11 11 

ldaa 

#$F0 


r OLIO 

y i 

OA 

OU 


11 11 

staa 

D A 


F6DE 


Uo 

FP, 
HO 

II II 

ldx 

ffipUoCiO 

X V 1UUU 

F6E1 

BD 

FB 

F0 

II II 

jsr 

$FBF0 


F6E4 

86 

08 


II 11 

ldaa 

#$08 

we- 

F6E6 

97 

OZ 



staa 

PB 


F6E8 

BD 

F7 

A7 

ii f 

II II 

jsr 

$F7A7 


F6EB 

88 

04 


11 11 


#$04 


frfh 

Q7 

OZ 


11 11 

staa 



F6EF 

C6 

Fl 


II II 

ldab 

#$F1 


F6F1 

D7 

80 



stab 

PA 


F6F3 

08 



11 tt 

inx 



F6F4 

09 



11 tt 

dex 



F6F5 

01 



11 tt 

nop 



F6F6 

D6 

74 


II t „ 

ldab 

$0074 


F6F8 

27 

03 


11 ; 11 

beq 

$F6FD 


F6FA 

BD 

FB 

C6 

11 II 

jsr 

$FBC6 


F6FD 

88 

04 


11 11 

eora 

#$04 


F6FF 

97 

82 


11 11 

staa 

PB 


F701 

01 



11 tt 

nop 



F702 

D6 

74 


" t" 

ldab 

$0074 


F704 

BD 

FC 

D2 

II II 

jsr 

$FCD2 



60 


F707 : 7E F9 10 


F70A : C6 03 
A6 00 


F70C 



08 

A6 00 



76 00 65 
39 


76 00 51 
76 00 52 
76 00 53 
76 00 54 
76 00 55 
76 00 56 
76 00 57 
76 00 58 
39 


74 00 59 
76 00 5A 
76 00 5B 
76 00 5C 
76 00 5D 
76 00 5E 
76 00 5F 
76 00 60 
39 


9F 61 
9E 63 



46 

25 05 
BD F7 26 


Z" 


F" 

$ " 

V 


v e" 
9" 


v Q" 
v R" 
v S" 
v T" 
v U" 
v V" 
v W" 
v X" 


t Y" 
v Z" 
v [" 
v \" 
v ] " 


V ' 

9" 


f " 
2" 


F" 
•/. " 


J m P 

ldab 

ldaa 


rora 

bcc 

com 


decb 

bne 

rts 


lnx 
ldaa 


rora 

bcc 

incb 


ror 
rts 


ror 
ror 
ror 
ror 
ror 
ror 
ror 
ror 
rts 


lsr 
ror 
ror 
ror 
ror 
ror 
ror 
ror 
rts 


sts 
Ids 


ldaa 

staa 

pula 

sts 

Ids 


rora 
bcs 


$F910 
#$03 
$00, x 


$F714 
$0000 


$F726 
$F70E 


$00, x 


$F722 


$0065 


$0051 
$0052 
$0053 
$0054 
$0055 
$0056 
$0057 
$0058 


$0059 
$005A 
$005B 
$005C 
$005D 
$005E 
$005F 
$0060 


$0061 
$0063 


#$08 
$0066 

$0063 
$0061 


$F76D 
$F726 


display "beep?" 

get 1 digit of key & put in buffer 

get oct key digit 

we shift digit right (lsb 1st) 

toggle parity if bit is 1 

put key bit into 51.58 

get leftover oct key digits 

count Is in b for parity 
put them in 65 

» bit into 64-bit fifo 51.58 


oldest bit in c 

» 0 into 64-bit fifo 59.60 


oldest bit in c 

interleave key/par into data bytes 
load table addr 

bit count 
66 <- 8 

get table byte 
save table ptr sp 
restore original sp 

ror table byte 

determines where we get bits 
if bit 0, get from 51.58 (key) 


61 


r l DD 

on 

ZU 

UO 


ii ii 

bra. 

<pr 1 1 u 


r I DJJ 

D u 

F7 

"3F 
or 

ii 7 ii 

jsr 

ipr 1 or 

ii uit i , get irom oy . ou i,paiv 

F770 

24 

06 


"$ " 

bcc 

$F778 

key/par bit was 0 

F772 

E6 

00 



ldab 

$00 x 

get existing data 

F774 

DA 

73 


II gll 

orab 

$0073 

or in key/par bit per 73 (mask) 

F776 

E7 

00 


II II 

stab 

$00, x 

save as new data 

r f ( o 

AO 

UO 



II It 

inx 


next data byte 

F779 

9C 

no 


II II 


CpUUUU 

see if done (end) 

F77B 

27 

0B 


„, „ 

beq 

$F788 

done 

F77D 

7A 

00 

66 

"z f" 

dec 

$0066 

bit count (was 8) 

r f ou 

OR 
ZD 

CO 


II 0. II 

bne 

q)r i Do 

get more bits 

r f oz 

yr 

0 1 


a 

S"tS 

q>uuoi 



yd 

Do 


c 

1 Act 

pUUDO 

next table byte 

F786 

20 

D4 



bra 

$F75C 


r f oo 

yd 

0 1 


a. 

las 

q>uuoi 


1770 a 
r f OA 

oy 



y 

r"ts 



r f OB 

A ft 

no 
uu 



1 A -s a 

<bnn -u- 

■pUU , X 

clock out some key & cti 

F78D 

94 

75 


„ , u „ 


<fcnn7R 

CpUU / D 

cti from x+0 

F78F 

27 

02 



be^ 

$F793 


F791 

86 

40 


" a" 

ldaa 

#$40 

set cti6 per mask in 75 (7/6) 

U7QO 

r f yo 

Ffi 

ID 



1 A =Vi 

laaD 


key from x+16 

r f y o 


f O 


S 

andb 

$uu / o 


r f y i 

07 
Z ( 

no 
uz 


ii ; ii 

beq 



TT7QQ 
r r yy 

oil 

on 
zu 



oraa 

#$20 

set keyl per mask in 73 (1/0) 

F79B 

97 

82 



staa 

PB 


r f yu 

AO 

Uo 



ii tt 

inx 



r f yd 


U4: 


ii ii 

eora 

#<tnA 

WEpU'i 

toggle elk ( 10 eye width.) 

T77 A n 
r f Au 

y i 

QO 

oz 


,, ,, 

staa 

DD 


T7V A O 

yu 

no 


n ii 

cpx 

q>uuuu 


F7A4 

26 

E5 


"& " 

bne 

$F78B 


F7A6 

39 



"9" 

rts 



T77 A 7 
r 1 A ( 


no 
uu 

no 
uz 

II II 

1 A-r 

ffvpUUUZ 


F7AA 

86 

F3 


II II 


#$F3 


T77 A H 


~7A 


II -i- II 

X 

laaD 

ipUU / *± 


F7AE 

27 

03 


II ; II 

beq 

$F7B3 


F7B0 

BD 

FB 

C6 

II II 

J sr 

$FBC6 


F7B3 

C6 

OC 


II II 

ldab 

#$0C 


F7B5 

D7 

82 



stab 

PB 


F7B7 

97 

80 



staa 

PA 


F7B9 

D6 

74 


II t „ 

ldab 

$0074 


F7BB 

26 

65 


"fee" 

bne 

$F822 


F7BD 

A6 

00 


ii ii 

ldaa 

$00, x 


F7BF 

97 

82 


ii ii 

staa 

PB 


F7C1 

88 

04 


n ii 

eora 

#$04 


F7C3 

66 

00 


"f " 

ror 

$00, x 


F7C5 

8C 

00 

15 

ii ii 

cpx 

#$0015 


F7C8 

27 

07 


II ; II 

beq 

$F7D1 



62 


F7CA 
F7CC 
F7CE 
F7CF 


97 82 
96 75 
08 

20 EC 


F7D1 : 97 82 

F7D3 : 08 

F7D4 : C6 36 

F7D6 : F7 00 81 


F822 

CO 

02 

F824 

01 


F825 

01 


F826 

26 

FA 


staa 

PB 

ldaa 

ipuu / o 

inx 


bra 

q>b (ou 

staa 

PB 

inx 


ldab 

#$36 

stab 

CRA 

ldaa 

$00, x 

staa 

PB 

eora 

#$04 

ror 

$00, x 

cpx 

#$0050 

beq 

$F7ED 

staa 

PB 

ldaa 

$0075 

inx 


bra 

$F7D9 


staa PB 

ldx #$0002 

nop 

nop 

nop 


ldaa $00, x 

anda #$FB 

staa PB 

eora #$04 
inx 


ldab $0075 

cpx #$0051 

beq $F80B 

staa PB 

ldaa $00, x 

bra $F7F5 


staa 

PB 

ldab 

$0075 

ldab 

#$3E 

stab 

CRA 

ldaa 

$00, x 

anda 

#$FB 

staa 

PB 

eora 

#$04 

tst 

$00, x 

nop 


nop 


jmp 

$F8E0 

subb 

#$02 

nop 


nop 


bne 

$F822 


F7D9 

A6 

00 


11 11 

F7DB 

97 

82 


11 11 

F7DD 

88 

04 


11 11 

F7DF 

66 

00 


"f " 

F7E1 

8C 

00 

50 

ii p „ 

F7E4 

27 

07 


11 ; (1 

F7E6 

97 

82 


11 (1 

F7E8 

96 

75 


" u" 

F7EA 

08 



11 tt 

F7EB 

20 

EC 


11 11 

F7ED 

97 

82 


11 11 

F7EF 

CE 

00 

02 

11 II 

F7F2 

01 



11 tt 

F7F3 

01 



11 It 

F7F4 

01 



11 tt 

F7F5 

A6 

00 


11 11 

F7F7 

84 

FB 


11 11 

F7F9 

97 

82 



F7FB 

88 

04 


11 11 

F7FD 

08 



11 tt 

F7FE 

D6 

75 


" u" 

F800 

8C 

00 

51 

" Q" 

F803 

27 

06 


11 ; 11 

F805 

97 

82 


11 11 

F807 

A6 

00 


11 (1 

F809 

20 

EA 


11 (1 


F80B 

97 

82 

11 11 

F80D 

D6 

75 

" u" 

F80F 

C6 

3E 

" >" 

F811 

D7 

81 

11 11 

F813 

A6 

00 

11 11 

F815 

84 

FB 

11 11 

F817 

97 

82 


F819 

88 

04 

11 11 

F81B 

6D 

00 

"m " 

F81D 

01 


ii tt 

F81E 

01 


ii tt 

F81F 

7E 

F8 E0 

ii ~ ii 


63 


F828 

A6 

00 

11 11 

F82A 

97 

82 

11 11 

F82C 

88 

04 

11 11 

F82E 

66 

00 

"f " 

F830 

F6 

00 74 

" t 

F833 

CO 

02 


F835 

27 

06 



F837 

CO 

02 

F839 

01 


F83A 

01 


F83B 

26 

FA 


F859 

CO 

02 

F85B 

01 


F85C 

01 


F85D 

26 

FA 


F85F : C6 36 
F861 : D7 81 


F872 

CO 

02 

F874 

01 


F875 

01 


F876 

26 

FA 


ldaa $00, x 

staa PB 

eora #$04 

ror $00, x 

ldab $0074 

subb #$02 

beq $F83D 


subb #$02 
nop 
nop 

& " bne $F837 


cpx #$0015 

beq $F84F 

staa PB 
inx 

ldab $0074 


subb #$02 

nop 

nop 

bne $F847 
bra $F828 


staa PB 
inx 
nop 

ldab $0074 

subb #$02 

beq $F85F 

subb #$02 
nop 
nop 

& " bne $F859 


6" ldab #$36 

stab CRA 


ldaa $00, x 

staa PB 

eora #$04 

ror $00, x 

ldab $0074 

subb #$02 

beq $F878 


subb #$02 
nop 
nop 

& " bne $F872 


cpx #$0050 
beq $F88A 
staa PB 


F878 
F87B 
F87D 


8C 00 50 
27 0D 
97 82 


P" 


F83D 

8C 

00 15 

11 

F840 

27 

0D 

11 ; 11 

F842 

97 

82 

11 11 

F844 

08 


11 it 

F845 

D6 

74 

" t" 

F847 

CO 

02 

(1 (1 

F849 

01 


(1 tt 

F84A 

01 


(1 tt 

F84B 

26 

FA 

"& " 

F84D 

20 

D9 

11 11 

F84F 

97 

82 

11 11 

F851 

08 


11 it 

F852 

01 


(1 tt 

F853 

D6 

74 

II t „ 

F855 

CO 

02 

11 11 

F857 

27 

06 

11 ; (1 


F863 

A6 

00 

F865 

97 

82 

F867 

88 

04 

F869 

66 

00 

F86B 

F6 

00 74 

F86E 

CO 

02 

F870 

27 

06 


f " 
t" 


64 


F87F : 08 
F880 : D6 74 


II 

t" 


inx 

ldab $0074 


F882 

CO 

02 


11 II 

subb 

#$02 

F884 

01 



II tl 

nop 


F885 

01 



II tt 

nop 


F886 

26 

FA 


"ft " 

bne 

$F882 

F888 

20 

D9 


ii 

bra 

$F863 

r ooii 


OZ 


ii ii 


PB 

F88C 

D6 

74 


" t" 

ldab 

$0074 

F88E 

D6 

74 


" t" 

ldab 

$0074 

F890 

CO 

02 


II II 

subb 

#$02 

F892 

01 



II tt 

nop 


F893 

01 



II tt 

nop 


F894 

26 

FA 


"ft " 

bne 

$F890 

F896 

CE 

00 

02 

II II 

ldx 

#$0002 

F899 

A6 

00 


II II 

ldaa 

$00, x 

F89B 

84 

FB 


II II 

anda 

#$FB 

F89D 

97 

82 


II II 

staa 

PB 

F89F 

88 

04 


II II 

eora 

#$04 

F8A1 

D6 

74 


" t" 

ldab 

$0074 

F8A3 

08 



II It 

inx 


F8A4 

CO 

02 


II II 

subb 

#$02 

F8A6 

01 



II It 

nop 


F8A7 

01 



II tt 

nop 


F8A8 

26 

FA 


"& " 

bne 

$F8A4 

F8AA 

8C 

00 

50 

" P" 

cpx 

#$0050 

F8AD 

27 

OD 


II ; II 

beq 

$F8BC 

F8AF 

97 

82 


II II 


PB 

F8B1 

D6 

74 


" t" 

ldab 

$0074 

F8B3 

CO 

02 


II II 

subb 

#$02 

F8B5 

01 



II tt 

nop 


F8B6 

01 



II tt 



F8B7 

26 

FA 


"& " 

bne 

$F8B3 

F8B9 

01 



II tt 

nop 


F8BA 

20 

DD 


II II 

bra 

$F899 

F8BC 

97 

82 


II II 

staa 

PB 

F8BE 

01 



II tt 

nop 


F8BF 

01 



II tt 

nop 


F8C0 

D6 

74 


" t" 

ldab 

$0074 

F8C2 

CO 

02 


II II 

subb 

#$02 

F8C4 

27 

06 


II ; II 

beq 

$F8CC 

F8C6 

CO 

02 


II II 

subb 

#$02 

F8C8 

01 



II tt 

nop 


F8C9 

01 



II it 

nop 


F8CA 

26 

FA 


"& " 

bne 

$F8C6 

F8CC 

C6 

3E 


,, >„ 

ldab 

#$3E 

F8CE 

D7 

81 


n n 

stab 

CRA 

F8D0 

A6 

00 


n n 

ldaa 

$00, x 


65 


r OUZ 

RA 

r D 



ii ii 


and a 

#ipr £5 

F8D4 

97 

82 



ii ii 



PB 

F8D6 

88 

04 



ii ii 


eora 

#$04 

F8D8 

F6 

00 

74 


ii t „ 


ldab 

$0074 

F8DB 

5A 




"Z" 


decb 


r ou<j 

ni 

Ul 




II It 


nop 


F8DD 

01 




II tt 


nop 


F8DE 

26 

FB 



"ft » 


bne 

$F8DB 

F8E0 

97 

82 



II II 


staa 

PB 

r OSLZ 

oy 




ii o ii 

y 


I"tS 


r OSLO 

PO 
oz 

zu 

U 1 


r\7 CA P7 
1J f OA Ei f 




F8EB 

08 

6D 

6D 

72 

42 44 09 

30 



F8F3 

D5 

40 

47 

19 





r or f 

TV 
l r 

y r 

U 1 

D 1 

Q7 RR 
3 1 O 1 OO 

OP. 



F8FF 

E3 

IP 

■3D 

9Q 

zy 

21 

A7 ar rr 

At 

2A 



r yu f 

uu 








F908 

52 

00 

9B 

Fl 

ED 40 EA 

C2 



F910 

CE 

FF 

C5 


II II 


ldx 

#ipr r \jO 

F913 

BD 

Fl 

CO 


II II 


J sr 

$F1C0 

F916 

BD 

Fl 

70 


" p" 


J sr 

$F170 

F919 

39 




"9" 


rts 


F91A 

86 

08 





ldaa 

#$08 

F91C 

97 

82 



II II 


staa 

PB 

F91E 

08 




II II 


inx 


F91F 

86 

OC 



II II 


ldaa 

#$0C 

F921 

97 

82 



II II 


staa 

PB 

F923 

CE 

00 

08 


II II 


ldx 

#$0008 

F926 

86 

08 



II II 


ldaa 

#$08 

F928 

97 

66 



" f" 


staa 

$0066 

F92A 

C6 

10 



II II 


ldab 

#$10 


F92C 
F92D 
F92E 
F930 


F932 
F934 
F935 
F936 
F938 
F93A 
F93D 
F93F 
F940 
F942 


4F 
59 

24 02 
86 20 


97 82 

01 

01 

88 04 
97 82 
7A 00 66 
26 ED 
09 

26 E4 
CE 00 E8 


0" 
Y" 
$ » 


clra 
rolb 
bcc 
ldaa 


z f" 


staa 

nop 

nop 

eora 

staa 

dec 

bne 

dex 

bne 

ldx 


$F932 
#$20 


PB 


#$04 
PB 

$0066 
$F92C 

$F926 
#$00E8 


key -> data byte encoder table 
these 20 bytes hold 80 dibits 
used as CTI during key load 

key/par "interleave" table (1st) 

key/par "interleave" table (2nd) 

taps for Galois parity register 


F945 : 86 28 


n ^ ii 


ldaa 


#$28 


66 


F947 

97 

82 


11 II 

staa 

PB 

F949 

88 

04 


II II 

eora 

#$04 

F94B 

08 



II tt 

inx 



AO 

uy 



II tt 

dex 


F94D 

08 




inx 


F94E 

09 




dex 


F94F 

97 

82 



staa 

PB 

F951 

08 




inx 


F952 

09 




dex 


F953 

09 




dex 


F954 

26 

EF 


"& " 

bne 

q>r y4b 

F956 

9F 

61 


II a ll 

sts 

$0061 

r yob 

L-n. 

T7T7 

r r 


II II 

lax 

■#tbT7T7pn 
ffEpr r KjU 

F95B 

C6 

08 



ldab 

#$08 

r you 

oo 

zo 


II / II 

. . . 
ldaa 

ffipzo 

r yor 

Q7 

y i 



II II 

staa 

DP 

F961 

88 

04 



eora 

#$04 

F963 

97 

82 



staa 

PB 

F965 

96 

80 


II II 

ldaa 

PA 

F967 

46 



"F" 

rora 


F968 

46 



n pit 

rora 


r yt>y 




II 17 II 

r 

rora 



A C 



II 17 II 

r 

rora 


F96B 

79 

00 

46 

"y F" 

rol 

q>UU4o 

F96E 

5A 



ii ^ ii 

decb 


F96F 

26 

EC 


"ft " 

bne 

$F95D 

F971 

E6 

00 


,, ,, 

ldab 

$00, x 

F973 

Dl 

46 


n pn 

cmpb 

$0046 

F975 

27 

07 



beq 

q>r y ( h 

F977 

C6 

00 


„ „ 

ldab 

#$00 

F979 

D7 

69 


" i" 

stab 

$0069 

F97B 

7E 

FB 

87 


j m P 

iprbo / 

F97E 

08 




inx 


F97F 

8C 

FF 

D5 

ii n 

cpx 

#$FFD5 

F982 

26 

D7 


"ft » 

bne 

$F95B 

F984 

9F 

61 


n a ii 

sts 

q>Uuol 

F986 

8E 

01 

CE 

I "„ 

Ids 

#tp(JlL.t 

T7QS5Q 

r yoy 


UU 

no 


ldx 

4f ttjnnno 

Tenor 1 

OO 



II II 

ldaa 

#$04 

F98E 

97 

65 


II Q ll 

staa 

(kAAC I- 

$0065 

F990 

32 



"2" 

pula 


F991 

46 



..p.. 

rora 


F992 

C4 

00 



andb 

#$00 

F994 

24 

02 


„ $ I, 

bcc 

$F998 

F996 

C6 

40 


II @ll 

ldab 

#$40 

F998 

E7 

00 


II II 

stab 

$00, x 

F99A 

08 



II tt 

inx 


F99B 

7A 

00 

65 

"z e" 

dec 

$0065 

F99E 

26 

Fl 


"ft " 

bne 

$F991 

F9A0 

8C 

00 

42 

,i B .i 

cpx 

#$0042 

F9A3 

26 

E7 


"ft " 

bne 

$F98C 


67 


r yfto 

yCi 

DO 


C 

las 

<fcnnfi*3 
q>uuoo 

F9A7 

34 



II 4" 



T7Q A P 
r yAo 

I r 

nn 
uu 

nn 
uu 



<bnnnn 

■pUUUU 

F9AB 

96 

6F 


„ 0 ,l 

ldaa 

$006F 

F9AD 

4A 



,IJ„ 

deca 


T7Q AC 
r yAEj 

Q7 

y i 

A Q 


II T II 
1 

staa 

<tnnAQ 
ipuu^ty 


OD 

u f 



ldaa 

WEpU f 

r y D Z 

Q7 

y i 

DO 



staa 

q>UUOO 

r ytS^i 


no 
uu 

no 
uz 

ii ii 

-LQ.X 

atfcnnno 

F9B7 

86 

04 


ii ii 

ldaa 

#$04 

T7QRQ 

y f 

DO 


ii rt ii 

e 

staa 

q>UUoo 

T70.RR 

r y dd 

"50 
OZ 



ii o " 

z 

pula 


T7QRP 

r you 

A Q 

4y 



II T » 

i 

rola 


F9BD 

AQ 
*±y 



ii j ii 

rola 



AO 

*±y 



II T II 

± 

rola 


F9BF 

49 



"i" 

rola 



AQ 

*±y 



II T II 
± 

rola 


r yui 

OA 

z*± 

UD 


ii * ii 

bec 

$r yoy 

■cap*} 
r yuo 


on 
zu 


II II 

iQdD 

jttfcon 

WEpZU 

r yuo 


no 
uu 


II II 

orab 

<bnn 

■pUU , X 

T7QP7 

r yu f 


no 
uu 


II II 

stab 

<bnn 
3>uu , X 

F9C9 

08 



II tt 



r yuii 

UD 

D / 


II —II 

s 

IQdD 

■pUUD 1 

r yuu 

PA 

a n 

*±U 


II (7\ II 

andb 

#<tAn 

Wip^iU 

F9CE 

27 

ID 


II ; II 

beq 

$F9ED 

F9D0 

25 

03 


"7. " 

bes 

$F9D5 

F9D2 

73 

00 

00 

"s " 

com 

$0000 

r yuo 

7 A 

UU 

ecu 
DD 

II— -p H 
Z I 

dec 

q>UUoD 

r yuo 

OR 
ZD 

1 "5 
lo 


II 0. II 

(L 

bne 

$r ynxi 



n7 
u / 


II II 

iQau 

jtttnv 

#ipU f 

r yuu 

U 1 

DD 


II -f II 

stab 

<fcnnfifi 

q>UUDD 

r yUEj 

/ O 

nn 
uu 

nn 
uu 

II,, II 

ror 

q>uuuu 

F9E1 

24 

09 


"$ " 

bec 

$F9EC 

F9E3 

C6 

20 


II II 

ldab 

#$20 

F9E5 

EA 

00 


II II 

orab 

$00 x 

T70.T77 
r yt f 

U7 

r. / 

no 
uu 


II II 

stab 

$00 , x 

F9E9 

7F 

00 

00 

II II 

clr 

$0000 


OR 



II tl 

nix 


F9ED 

7k 

00 

65 

"z e" 

dec 

$0065 

F9F0 

26 

CE 


"& " 

bne 

$F9C0 

F9F2 

7A 

00 

49 

„ z j.i 

dec 

$0049 

F9F5 

26 

CO 


"& " 

bne 

$F9B7 

F9F7 

C6 

40 


.1 QM 

ldab 

#$40 

F9F9 

8E 

00 

01 


Ids 

#$0001 

F9FC 

32 



,, 2 „ 

pula 


F9FD 

97 

82 


II II 

staa 

PB 

F9FF 

01 



II tl 

nop 


FAOO 

01 



II II 

nop 


FA01 

88 

04 


II II 

eora 

#$04 

FA03 

97 

82 


II II 

staa 

PB 


68 


FA05 

5A 



"Z" 

decb 


r iiUo 

ZD 

17 A 


« 9r « 
fit 

bne 

Ipr yr L/ 

FA08 

C6 

40 



ldab 

#$40 

FAOA 

8E 

00 

01 


Ids 

TftpUOOl 

FAOD 

32 



ii 2» 

pula 


FAOE 

84 

20 



and a 

#$20 

FA10 

27 

02 



beq 

$FA14 

FA12 

86 

01 



ldaa 

#$01 

FA14 

8A 

08 



oraa 

#$08 

FA16 

36 



"6" 

psha 


FA 17 

31 



ii ii 

ins 


FA18 

5A 



"Z" 

decb 


T7 A 1 Q 

ZD 

CO 

r z 


n o. ii 
fit 

bne 

<feir A nn 

FA1B 

9E 

61 


" a" 

Ids 

$0061 

FA1D 

CE 

00 

FA 

11 II 

ldx 

#$00FA 

T7ft OH 

r ilzu 

DU 

T7D 
r D 

r U 

11 II 

jsr 

q>r Br U 

FA23 

86 

F0 



ldaa 

#$F0 

r iizo 

Q7 

y f 

OA 

OU 


11 11 

staa 

D A 

FA27 

CE 

02 

58 

II X" 

ldx 

#3>0zoo 

17 A O A 

BD 

FB 

PA 

r U 

11 II 

jsr 

ipr Br U 

FA2D 

86 

B9 



ldaa 

#$B9 

T7 A OT7 

y ( 

on 
oU 


11 11 

staa 

D A 


Q7 

y ( 

QO 
oZ 


11 11 

staa 

PB 

FA33 

CE 

01 

90 


ldx 

#ipUlyu 


UD 

1 A 


II +. II 

ldab 

*AA7/| 

FA38 

27 

03 


11 ; 11 

beq 

$FA3D 

FA3A 

BD 

FB 

C6 

II II 

jsr 

$FBC6 

FA3D 

BD 

FB 

F0 


jsr 

!prbr 0 

TT A AC\ 
r AffcU 

rio 

uo 



11 tt 

inx 



ni 

Ul 



(I tt 

nop 


FA42 

CE 

00 

08 


ldx 

#3>UU0o 

T7 A A d 

oo 



11 11 

eora 


FA47 

97 

82 



staa 

PB 

FA49 

C6 

36 


" 6" 

ldab 

#$36 

FA4B 

D7 

81 


11 11 

stab 

CRA 

FA4D 

F6 

00 

74 

II II 

ldab 

q>Ou / 4 

FA50 

27 

03 


l 3 "|| 

beq 

$FA55 

T7 A CO 

BD 

FB 

l^D 


jsr 

Ipr D\jO 

FA55 

88 

04 


11 11 


#$04 

FA57 

97 

82 


11 11 

staa 

PB 

FA59 

01 



11 It 

nop 


FA5A 

01 



11 tt 

nop 


FA5B 

BD 

FC 

OF 

11 II 

J sr 

$FC0F 

FA5E 

27 

05 


11 J 11 

beq 

$FA65 

FA60 

C6 

01 



ldab 

#$01 

FA62 

7E 

FB 

6E 

II- n ll 

jmp 

$FB6E 

FA65 

C6 

3E 


1, >H 

ldab 

#$3E 

FA67 

D7 

81 


11 11 

stab 

CRA 

FA69 

F6 

00 

74 

„ t „ 

ldab 

$0074 

FA6C 

27 

03 


11 ; 11 

beq 

$FA71 

FA6E 

BD 

FB 

C6 

11 II 

j sr 

$FBC6 


69 


T7 A 71 
r A < 1 

QQ 
OO 

U'i 


11 II 

eora 


FA73 

97 

82 


II II 


PB 

FA75 

BD 

FC 

47 

" G" 

J sr 

$FC47 

FA78 

BD 

FC 

78 

" x" 


$FC78 

T7 A 7R 
r A < C 

op 

flA 
U'i 


II II 

eora 


FA7D 

97 

82 


II II 


PB 

FA7F 

6D 

00 


"m " 

tst 

$00, x 

FA81 

88 

04 



eora 

#$04 

T7 A P.Q 
r Aoo 

DO 

7A 


ii -i- ii 

X 

J-QcLD 

3>uu / *± 

r Aoo 

Z ( 

UO 


II ; II 

beq 

<tT7 A P. A 
ipr AOA 

r AO f 

rh 

T7R 

OO 

II II 

jsr 

<fcT7RPfi 
3>r COO 

T7 A 55 A 
r AoA 

CD 

17 P 

r 0 

1 T7 

lr 

II II 

jsr 

<tT7P-1 17 

<pr O lr 

T7 A S5T\ 
r AoD 

Oft 
ZO 

Uo 


II 0. II 

fit 

bne 

<pr Ay4 

FA8F 

PR 

OO 

no 
uz 


ii ii 

J-ClcLD 

#$02 

T7 AQ 1 
r Ay 1 

7T7 

/ IL 

T7R 
r D 

RT7 

Oil 

ii - —ii 

n 

J m P 

<tT7RRT7 
Jpr COIL 

FA94 

D6 

74 


„ t „ 

ldab 

$0074 

T7 A Qft 
r AyO 

17 
Z ( 

Uo 


II ; II 

beq 

<tT7 A QR 
■j>r Ayt5 

FA98 

BD 

FB 

C6 

II II 

jsr 

<tT7Rpfi 
•ptr D\jO 

FA9B 

CE 

00 

06 

II II 

ldx 

#$0006 

T7 AQT7 
r AyiL 

OO 



II -i II 
-L 

IQdd 

ffipOL. 

T7 A A 
r AAU 

HQ 
Uo 



II it 

inx 


FAA1 

97 

82 


II II 

staa 

PB 

T7 A A *5 
r AAo 

uy 



II it 

dex 


FAA4 

BD 

FC 

OF 

II II 

jsr 

$FC0F 

T7 A A 7 
r AA f 

17 
Z ( 

Uo 


II ; II 

beq 

<tT7 A AT7 

q>r AAil 

T7 A A Q 
r AAi? 

OO 

UO 


II II 

iQaD 

ffipUO 

T7 A AD 
r AAC 

7T7 

/ IL 

T7R 
r D 

RT7 
OIL 

II - _ii 

n 

j m P 

<tT7RfiT7 
3>r COIL 

T7A A 17 
r AAtj 

T7£ 
r 0 

UU 

7/1 

II -4— II 

X 

laao 

q>UU / 4 

FAB1 

17 
Z ( 

Uo 


II ; II 

beq 

*T7ARf=: 
ipr ADO 

FAB 3 

BD 

FB 

C6 

II II 


$FBC6 

T7 ARfi 
r ABO 

OO 

OIL 


II y II 

laau 

J*tt'5T7 
ffipOIL 

T7 AR55 
r ACo 

n7 

Q -i 

Ol 


II II 

stab 

PR A 

T7 AR A 
r ACA 

Qp 
OO 

nA 

U4: 


II II 

eora 


T7 ARP 

Q7 

y f 

OZ 


II II 

staa 

DR 

FABE 

BD 

FC 

47 

„ G „ 

j sr 

$FC47 

FAC1 

BD 

FC 

78 

" x" 

j sr 

$FC78 

T7 A PA 

pp 

OO 

U4: 


II II 

eora 


T7 A Pfi 
r AOO 

Q7 

y i 

on 
OZ 


II II 

staa 

DR 

T7 A P55 
r Aoo 

Uo 



II It 

inx 


FAC9 

D6 

74 


" t" 

ldab 

$0074 

FACB 

27 

03 


II ; II 

beq 

$FAD0 

FACD 

BD 

FB 

C6 

II II 

j sr 

$FBC6 

FADO 

CE 

04 

B0 


ldx 

#$04B0 

FAD3 

BD 

FC 

09 


J sr 

$FC09 

FAD6 

26 

05 


«k " 

bne 

$FADD 

FAD8 

C6 

04 


II II 

ldab 

#$04 

FADA 

7E 

FB 

6E 

"~ n" 

jmp 

$FB6E 

FADD 

C6 

3E 


" >" 

ldab 

#$3E 

FADF 

D7 

81 


II II 

stab 

CRA 

FAE1 

F6 

00 

74 

" t" 

ldab 

$0074 


70 


FAE4 

27 

03 


11 ; II 

beq 

$FAE9 

FAE6 

BD 

FB 


II II 

jsr 


FAE9 

88 

04 


II II 

eora 

#$04 

T7 APR 

y i 

on 
OZ 


II II 

staa 

DD 

rD 

FAED 

BD 

FC 

47 

" G" 

jsr 

$FC47 

FAFO 

08 



: " „ 

inx 


FAF1 

CE 

00 

97 


ldx 

#$0097 

FAF4 

88 

04 


ii ii 

eora 

#$04 

FAF6 

97 

82 


ii ii 


PB 

FAF8 

D6 

74 


ii ^.ii 

ldab 

$0074 

T7 A 17 A 

07 
Z 1 

uo 


II ; II 

beq 

<tT7 APT7 

FAFC 

BD 

FB 


II II 

jsr 

•ptr D\jO 

FAFF 

BD 

FC 

09 

II II 

jsr 

$FC09 

r BUZ 

07 
Z ( 

UO 


II ; II 

beq 

■pr cuy 

FB04 


UO 


II II 

J-ClcLD 

ff$UO 

r J3UD 

7T7 

r D 

DEj 

II - -.11 

n 

J m P 

$r boil 

FB09 

Lit 

UU 

A A 

D 

ldx 
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$0074 


FDA4 

D6 

74 


II t „ 

ldab 

$0074 


FDA6 

27 

03 


II ; II 

beq 

$FDAB 



rh 

15 u 

r D 


II II 

jsr 

3>r CUD 


FDAB 

BD 

FB 

F0 

II II 

jsr 

$FBF0 


AC 




II Q H 

y 

rts 



T7D AT7 

yo 

70 
f Z 


ii ii 

T 

ldaa 

<tnn70 
q>uu / z 


FDB1 

27 

09 



beq 

$FDBC 


FDB3 

81 

01 


ii ii 

cmpa 

#$01 


FDB5 

07 
Z f 

1 7 



beq 



FDB7 

Ol 

U f 


n ii 

cmpa 

rfipU 1 


T7T1PQ 

ZD 

on 
oZ 


11 PrO " 

66 Z 

bne 

<fcirncn 


T7T1RR 

QQ 



II o II 

y 

rt S 



r JJJdU 


T7T7 
r r 

no 
DO 

II II 

-LQ.X 

#ttT7TTRQ 
rTipr ri5o 

LiOC : 

r JJi5r 

RH 
15 U 

TP 1 

r 1 


II II 

jsr 


put table chars in buffer 

T7T1PO 
r JJOZ 

RH 
15 JJ 

TP 1 

r 1 

/ u 

II _ II 

p 

jsr 

<tT71 7n 
$r 1 / U 

wr i t e buf f er to d i sp 1 ay 

FDC5 

86 

05 


II II 

ldaa 

#$05 


FDC7 

97 

69 


II j_M 

staa 

$0069 


FDC9 

7C 

00 

72 

"1 r" 

inc 

$0072 


r JJUL. 

on 
zu 

OR 


II . II 
> 

bra 

$r EiUy 


FDCE 

CE 

FF 

AD 

II II 

ldx 


v.6 spaces,) 

FDDl 

BD 

Fl 

CO 

II II 

jsr 

$F1C0 

put table chars in buffer 

FDD4 

86 

8B 


II II 

ldaa 

#$8B 


r JJLio 

y / 

O 1 


ii n 

H 

staa 

q>uuoi 


r jjuo 

OD 

Z1R 
4:15 


ii yii 

ldaa 



T?nn A 

Q7 

y f 

c;o 


ii p ii 

staa 

<fcnnc;o 
q>uuoz 


r UU<j 

OO 

no 
uz 


ii ii 

ldaa 

rfipUZ 


r jjuEj 

Q7 

y f 

CQ 


ii j ii 
1 

staa 

<bnnRQ 
q>uuoy 


■crvcn 


nn 

no 
uz 

ii ii 

-LQ.X 

atfcnnno 

rTipUUUZ 


r JJto 

Dr 



II M" 

n 

stx 



FDE5 

6F 

00 


n _ n 
o 

clr 

*nn 
$00 , x 


r DEi ( 

Ui5 



ii it 

inx 



r JJEiO 


nn 
uu 

no 
uo 

ii ii 

cpx 

#ttnnnp 

rTipUUUO 


FDEB 

Zo 

T7Q 

r o 


II 0. II 

06 

bne 

ipr Itto 


FDED 

96 

68 


" h" 

ldaa 

$0068 


FDEF 

DE 

4D 


» M" 

ldx 

$004D 


FDF1 

A7 

00 



staa 

$00, x 


FDF3 

BD 

FE 

60 


jsr 

$FE60 


FDF6 

DF 

63 


„ c „ 

stx 

$0063 


FDF8 

BD 

Fl 

AF 

II II 

jsr 

$F1AF 

convert oct to char 

FDFB 

7C 

00 

72 

„ | r „ 

inc 

$0072 


FDFE 

BD 

FF 

0D 

II II 

jsr 

$FF0D 


FE01 

7F 

00 

6E 

" n" 

clr 

$006E 


FE04 

DE 

4D 


» M " 

ldx 

$004D 


FE06 

08 



II II 

inx 



FE07 

DF 

4D 


» M " 

stx 

$004D 



78 


FE09 : BD Fl 70 
FEOC : 39 


P" 

9" 


jsr $F170 
rts 


write buffer to display 


FEOD 

96 

68 


" h" 

ldaa 

$0068 

FEOF 

5F 



11 II 



FE10 

46 



„ F „ 

rora 


FE11 

24 

03 


"$ " 

bcc 

$FE16 

FE13 

7C 

00 

00 

ii 1 n 
i 


$0000 

FE16 

5C 



"\" 

incb 


FE17 

CI 

04 


II II 

cmpb 

#$04 

FE19 

26 

F5 


"& " 

bne 

$FE10 

FE1B 

39 



„ 9 „ 

rts 


FE1C 

58 



"X" 

aslb 


FE1D 

58 



"X" 

aslb 


FE1E 

C4 

3C 


,, <„ 

andb 

#$3C 

FE20 

CA 

01 


II II 

orab 

#$01 

FE22 

D7 

82 


II II 

stab 

PB 

FE24 

39 



„g„ 

rts 


FE25 

CE 

01 

00 

II II 

ldx 

#$0100 

FE28 

4F 



IIQI, 

clra 


FE29 

OD 



II tt 

sec 


FE2A 

16 



II tt 

tab 


FE2B 

56 



"V" 

rorb 


FE2C 

56 



nyii 



FE2D 

56 



"V" 

rorb 


FE2E 

56 



"V" 

rorb 


FE2F 

C4 

IF 


II II 

andb 

#$1F 

FE31 

D7 

75 


" u" 

stab 

$0075 

FE33 

98 

75 


" u" 

eora 

$0075 

FE35 

A8 

00 


II II 

eora 

$00, x 

FE37 

46 



„ F „ 

rora 


FE38 

46 



lip II 



FE39 

46 



„ F „ 

rora 


FE3A 

46 



"F" 

rora 


FE3B 

84 

EO 


II II 

anda 

#$E0 

FE3D 

9A 

75 


" u" 

oraa 

$0075 

FE3F 

08 



II tt 

inx 


FE40 

8C 

01 

EO 

II II 

cpx 

#$01E0 

FE43 

26 

E5 


"& " 

bne 

$FE2A 

FE45 

39 



„g„ 

rts 


FE46 

B7 

01 

El 

II II 

staa 

$01E1 

FE49 

47 



"G" 

asra 


FE4A 

47 



"G" 

asra 


FE4B 

47 



"G" 

asra 


FE4C 

47 



"G" 

asra 


FE4D 

B7 

01 

E2 

II II 

staa 

$01E2 

FE50 

39 



„ 9 „ 

rts 


FE51 

CE 

01 

CO 

ii n 

ldx 

#$01C0 

FE54 

F6 

01 

FE 

ii n 

ldab 

$01FE 


x <- Ic0.1c7 based on key# 
?b <- key#? 


79 


FE57 : C4 07 


II II 


andb #$07 


FE59 

27 

04 


II ; II 

beq 

$FE5F 

FE5B 

08 



II tt 



FE5C 

5A 



"Z" 

decb 


FE5D 

20 

FA 


ii ii 

bra 

$FE59 

FE5F 

39 



"9" 

rts 


FE60 

CE 

00 

51 

" Q" 

ldx 

#$0051 

FE63 

D6 

69 


" i" 

ldab 

$0069 

FE65 

27 

04 


II ; II 

beq 

$FE6B 

r to I 




II it 



FE68 

5A 



"Z" 

decb 


FE69 

20 

FA 


ii ii 

bra 

$FE65 

FE6B 

39 



"9" 

rts 


FE6C 

5F 



II II 

clrb 


FE6D 

86 

01 


II II 

ldaa 

#$01 

FE6F 

9B 

4F 


" 0" 

adda 

$004F 

FE71 

97 

4F 


II Qll 


$004F 

FE73 

D9 

50 


II p„ 

adcb 

$0050 

FE75 

D7 

50 


" P" 

stab 

$0050 

FE77 

96 

4F 


" 0" 

ldaa 

$004F 

FE79 

27 

01 


ii ; ii 

beq 

$FE7C 

FE7B 

39 



"9" 

rts 


FE7C 

96 

6B 


" k" 

ldaa 

$006B 

FE7E 

26 

22 



bne 

$FEA2 

FE80 

96 

72 


" r" 

ldaa 

$0072 

FE82 

81 

01 


II II 

cmpa 

#$01 

FE84 

22 

1C 


II II II 

bhi 

$FEA2 

FE86 

CI 

25 


" '/." 

cmpb 

#$25 

FE88 

22 

01 


II II II 

bhi 

$FE8B 

FE8A 

39 



ngii 



FE8B 

BD 

Fl 

D2 

ii ii 

j sr 

$F1D2 

FE8E 

96 

50 


" p" 

ldaa 

$0050 

FE90 

81 

40 


ii a „ 

cmpa 

#$40 

FE92 

26 

03 


"& " 

bne 

$FE97 

FE94 

BD 

Fl 

53 

" S" 

j sr 

$F153 

FE97 

96 

50 


" p" 

ldaa 

$0050 

FE99 

81 

50 


" p" 

cmpa 

#$50 

FE9B 

22 

01 


ii ii ii 

bhi 

$FE9E 

FE9D 

39 



"9" 

rts 


FE9E 

BD 

F5 

87 


J sr 

$F587 

FEA1 

39 



„ 9 „ 

rts 


FEA2 

BD 

FE 

60 

ii ( ii 

jsr 

$FE60 

FEA5 

E6 

00 


ii ii 

ldab 

$00, x 

FEA7 

D7 

4A 


„ j„ 

stab 

$004A 

FEA9 

96 

50 


I. P „ 

ldaa 

$0050 

FEAB 

84 

01 



anda 

#$01 


80 


FEAD 

27 

04 


11 ; II 

beq 

$FEB3 

FEAF 

86 

R.n 


II II 

ldaa 

#$80 

FEB1 


no 


II II 

s aa 

$00 , x 

FEB 3 

BD 

Fl 

70 

" p" 

jsr 

$F170 

FEB 6 

BD 

FE 

60 

II ( II 

jsr 

$FE60 

FEB 9 


A A 
^±A 


J 

ldaa 

ipUU^fcA 

UUDD 

r EiDd 

A ( 

no 



staa 

<fcnn -ir 

;j>uu , X 

T7TTRn 

r ildU 

Oft 

yo 

ou 


II Dll 

r 

ldaa 

<fcnnc;n 
q>uuDU 

r n.£5r 

R 1 
£51 

uu 


ii ii 

cmpa 


r n.L/1 

ZD 

UO 


11 0. II 

bne 


r cAjO 

15 u 

r 1 

CO 
DO 

ii q ii 

jsr 

ipr lOO 

r 


ou 


ii pti 

ldaa 

<fcnnc;n 
q>uuDU 


R 1 
£51 

ny 


ii ii 

cmpa 


FECA 

22 

D2 


ii ii ii 

bhi 

$FE9E 

FECC 

39 



"9" 

rts 




T7T7 
r r 

An 

AJJ 

II II 

-LQ.X 

jt<tT7Tr An 
WEpr r AU 

FEDO 

BD 

171 

r 1 

L.U 

II II 

jsr 

ipr 1L-U 

FED 3 

B6 

01 

FE 

II II 

ldaa 

$01FE 

FED 6 

84 

07 


II II 

anda 

#$07 

FED 8 

CE 

00 

51 

ii nn 
W 

ldx 

ttipUUO J. 

r HJJd 

Ur 

DO 


ii - ii 
C 

S"tX 

ipUUDO 

r dLflJ 

15 1J 

r 1 

AT7 
Ar 

ii ii 

jsr 

<bT71 AT7 
3>r lAr 

TTTT'Fn 
r LEiU 

OR 

c; 1 
o 1 


ii n » 

H 

ldaa 

ipUUDl 

T7TTT70 

Rd 

7T7 


ii ii 

anda 


T7TTT7A 

y i 

o 1 


ii n <■ 

H 

staa 

q>uuD± 





II Q H 

y 

rts 


T7TTT77 

L-n. 

Ul 

UU 

ii ii 

lax 

TfipUlUU 

FEEA 

DF 

63 


„ c „ 

stx 

$0063 

FEEC 

F6 

01 

FE 

ii ii 

ldab 

$01FE 

FEEF 

C4 

07 


ii ii 

andb 

#$07 

FEF1 

27 

10 


II ; II 


$FF03 

FEF3 

5A 



"Z" 

decb 


FEF4 

96 

64 


,1 d ,l 

ldaa 

$0064 

FEF6 

8B 

18 


II II 

adda 

#$18 

FEF8 

97 

64 


II ^11 


"4? W W <J x 

FEFA 

96 

63 


II c ll 

ldaa 


FEFC 

89 

00 


II II 


#$00 

FEFE 

97 

63 


„ c „ 

staa 

$0063 

FFOO 

5D 



"]" 

tstb 


FF01 

20 

EE 


II II 

bra 

$FEF1 

FF03 

39 



"9" 

rts 


FF04 

01 



II tl 

nop 


FF05 

01 



II II 

nop 


FF06 

01 



II It 

nop 


FF07 

01 



II It 

nop 


FF08 

01 



II tt 

nop 


FF09 

01 



II It 

nop 


FFOA 

01 



II tt 




write buffer to display 


(6 spaces) 

put table chars in buffer 


convert oct to char 


63.64 <- start of key ram 
get key* 


quit when addr is correct 
add 24 to 63.64 for each key# 


81 


r r Ud 

Ul 



n tt 

nop 


FFOC 

39 



"9" 

rts 


FFOD 

7C 

00 

6E 

"1 n" 

inc 

$006E 

rrlu 


nn 

oy 

II 1 -I II 
1 1 

inc 

ipuuoy 

FF13 

08 




inx 


FF14 

C6 

81 



ldab 

#$81 

FF16 

E7 

00 


II II 

stab 

$00, x 

FF18 

39 



"9" 

rts 


FF19 

B6 

01 

DF 


ldaa 

q>01Ub 

FF1C 

84 

OF 


II II 

and a 

#$0F 

FF1E 

81 

OF 


II II 

cmpa 

#$0F 

FF20 

27 

11 


II ; II 

beq 

$FF33 

FF22 

CE 

01 

DO 

II II 

ldx 

#$01D0 

FF25 

4D 



" M " 

tsta 


r rzo 

2. ( 



II ; II 

. . . 

beq 

q>r r zL. 


Uo 



II tt 

inx 


FF29 

4A 



"j" 

deca 


FF2A 

20 

FA 


II II 

bra 

$FF26 

r rzo 

act. 
yo 



ii n << 
U 

ldaa 


FF2E 

A7 

00 


ii ii 

staa 

$00, x 

FF30 

7C 

01 

DF 

"l " 

inc 

$01DF 

FF33 

39 



"9" 

rts 


FF34 

4F 



II g ii 

clra 


FF35 

97 

6B 


II j^ii 

staa 

q>UUob 

FF37 

97 

72 


n j_ii 

staa 

q>UU / Z 

FF39 

97 

6E 


„ n „ 

staa 

$006E 

FF3B 

39 



"9" 

rts 


FF3C 

9F 

63 


ii c „ 

sts 

$0063 

FF3E 

9E 

61 


„ a „ 

Ids 

$0061 

FF40 

34 



"4" 

des 


FF41 

33 



„ 3 „ 

pulb 


FF42 

E7 

00 


II II 

stab 

$00, x 

FF44 

08 



II tt 

inx 


FF45 

4A 



"J" 

deca 


FF46 

26 

F9 


"& » 

bne 

$FF41 

FF48 

9E 

63 


„ c „ 

Ids 

$0063 

FF4A 

39 



"9" 

rts 


FF4B 

CE 

01 

00 


ldx 

#$0100 


FF4E 

6F 

00 


"o " 

clr 

$00, x 


FF50 

08 



II tt 

inx 



FF51 

8C 

02 

00 

II II 

cpx 

#$0200 


FF54 

26 

F8 


"& " 

bne 

$FF4E 


FF56 

86 

OA 


II II 

ldaa 

#$0A 


FF58 

B7 

01 

FD 

II II 

staa 

$01FD 


FF5B 

CE 

FF 

8E 

II II 

ldx 

#$FF8E 

All Erased 

FF5E 

BD 

Fl 

CO 

II II 

J sr 

$F1C0 

put table chars 


82 


FF61 
FF64 


BD Fl 70 
39 



$F170 write buffer to display 


FF7E 

FB 

BO 

ED 

F5 

B6 

D7 

DF 

FO 


0 

1 

2 

3 

4 

5 

6 

7 

FF86 

FF 

F7 

FE 

9F 

CB 

BD 

CF 

CE 


8 

9 

A 

b 

C 

d 

E 

F 

FF8E 

FE 

BA 

CF 

8C 

FE 

D7 

CF 

BD 


A 

11 

E 

r 

A 

S 

E 

d 

FF96 

80 

80 

8C 

CF 

FE 

BD 

B7 





r 

E 

A 

d 

y 


FF9D 

80 

80 

8B 

FB 

FE 

BD 

80 

81 



L 

D 

A 

d 




FFA5 

8B 

FB 

CB 

BE 

FE 

8C 

DB 

CF 


L 

0 

C 

H 

A 

r 

G 

E 

FFAD 

80 

80 

80 

80 

80 

80 





(6 spaces) 




FFB3 

80 

80 

8B 

FB 

4B 

EC 






L 

D 

C. 

■? 



FFB9 

80 

80 

CE 

FE 

BO 

8B 






F 

A 

I 

L 



FFBF 

80 

80 

EE 

FE 

D7 

D7 






P 

A 

S 

S 



FFC5 

80 

80 

9F 

CF 

CF 

6E 

EC 

80 




B 

E 

E 

P 

■? 


FFCD 

4F 

71 

48 

28 

31 

70 

7B 

04 


83 


FFD5 : 00 00 00 00 
FFD9 : 00 00 


FFDB 

OF 



II tt 

sei 


low battery interrupt 

FFDC 

96 

79 


" y" 

ldaa 

$0079 


FFDE 

8A 

10 



oraa 

#$10 


FFEO 

97 

79 


" y" 

staa 

$0079 


FFE2 

D6 

67 


" g" 

ldab 

$0067 


FFE4 

CA 

20 



orab 

#$20 


FFE6 

D7 

67 


" g" 

stab 

$0067 


FFE8 

CE 

FF 

A5 

ii ii 

ldx 

#$FFA5 

LOCharge 

FFEB 

BD 

Fl 

CO 

ii ii 

j sr 

$F1C0 

put table chars in buff 

FFEE 

BD 

Fl 

70 

" P " 

j sr 

$F170 

write buffer to display 

FFF1 

BD 

FF 

34 

" 4" 

j sr 

$FF34 


FFF4 

BD 

F3 

68 

" h" 

j sr 

$F368 


FFF7 

3B 



n . ii 
> 

rti 




FFF8 

FF 

DB 

IRQ 

FFFA 

FO 

00 

SWI 

FFFC 

FO 

00 

NMI 

FFFE 

FO 

00 

RST 


84 


